Portainer Release Notes

What's Changed

Feature

Added in-place upgrades with backup and automatic rollback #208

kubesoloctl upgrade, kubesoloctl rollback and kubesoloctl status, or the same through the configuration API (POST /api/v1/upgrade, POST /api/v1/rollback, GET /api/v1/status)

The binary, datastore and configuration are backed up, and the new version is tested against a copy of the datastore before switching over. It is rolled back automatically if it does not become healthy

A boot guard restores the previous version if the host loses power or reboots partway through an upgrade

Running install.sh with a newer version on an existing host upgrades it the same way

For more details, refer to this docs

KubeSolo now loads containerd drop-ins from /etc/containerd/conf.d, the standard directory used by containerd packaging and nvidia-ctk #206

/etc/containerd/config.d is still read

For more details, refer to this docs

Added --load-balancer=true|false and --load-balancer-ip to install.sh #204 #216

Set the IP published as a LoadBalancer Service's external IP on hosts with more than one network interface

Kubernetes, containerd and kine logs now use KubeSolo's single log format #210 #213

One component name per service, times to the millisecond, and no colour when output is not a terminal

Fixes

Fixed systemctl stop and restart hanging for 90s and ending in SIGKILL on a fully started node #207

Upgrading from v1.1.x or v1.2.0 now moves flag-based settings to the configuration file #211

install.sh now prints why an upgrade was aborted, rolled back or failed #211

Fixed a successful rollback being reported as failed when a short health timeout was used #211

Fixed upgrades and restarts on OpenRC (Alpine) failing with "already been started" #214

Fixed containerd shims being left running after a rollback or uninstall on OpenRC #215

KubeSolo's output on OpenRC now goes to syslog instead of being discarded #215

A clean reboot while an upgrade is being verified no longer rolls the upgrade back #215

Chore

Bumped github.com/moby/sys/user 0.4.0 -> 0.4.1 #212

New Contributors

@zoumingzhe made their first contribution in #204

Full Changelog: v1.2.1...v1.2.2

Original source

Breaking Changes

POST and PUT /api/cloud/gitcredentials now require urlPattern: one or more comma-separated glob patterns (for example github.com/portainer/) that a repository URL must match before the shared credential is used. * matches a single path segment; or scheme:// alone matches everything. Requests without urlPattern return 400. Credentials saved before upgrading keep working against any URL until they are edited; administrators should set a pattern on each existing shared credential

Known Issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

kubectl port-forward fails with Portainer kubeconfig in some configurations

Known issues with Podman

Support for only CentOS 9, Podman 5 rootful

Auto onboarding a Podman environment defaults to “Standard” and not “Podman”

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Known issues with Talos clusters managed by Omni (BE only)

Loading Omni specific information in the Cluster Details view and configuring an existing Talos cluster is currently restricted to Portainer Admins. Environment Admins will get a forbidden error when attempting to do this. This only applies to Omni configuration, and does not affect authentication for any other functionality in the cluster

New in this release

Security

Fixed a bypass of the "Hide bind mounts for non-administrators" setting. When it is enabled, Compose files deployed by non-administrators can no longer reference host files outside the stack directory (for example in configs, secrets or env_file), and include is disabled for them

Fixed a denied, failed or dry-run Kubernetes namespace deletion still removing Portainer's namespace access policies, stack records and registry bindings. These records are now removed only after Kubernetes accepts the deletion

Fixed in-cluster HTTPS connections to the Kubernetes API server skipping TLS certificate verification during stack deploy and removal, on both the server and the agent

Scoped shared Git credentials to URL patterns, so a credential is only sent to repository URLs that match its pattern. Previously any user could point a source at any saved credential and send it to any host

Fixed revoked namespace access staying in effect. Removing a user's or team's access through namespace access settings, Kubernetes RBAC policies or team membership changes now applies immediately. Previously cached Kubernetes clients kept read access for up to 8 hours, and the user's service account could keep write access until restart

Restricted kubeconfig tokens to Kubernetes API calls, so they can no longer be used against the rest of the Portainer API

Fixed the LDAP Kerberos service account password being returned in plaintext by GET /api/settings

Enforced the FIPS mode restriction on custom S3-compatible hosts on the server, for saving S3 backup settings, running a backup and restoring from S3, instead of relying on the UI alone

Added a FIPS mode warning to Azure Blob backup settings that ensuring the endpoint is FIPS compliant is the user's responsibility. Restoring from Azure with an auth method FIPS mode disallows is now rejected up front, and a scheduled Azure backup that FIPS mode makes invalid now logs why it isn't running

Features

Added a Node group column to the Kubernetes cluster node list for clusters using EKS, GKE, AKS, Karpenter or kops node pools, plus optional Instance type, Labels and Taints columns that can be turned on from the column menu

Added an API to issue, inspect and revoke scoped kubeconfigs (/api/kubernetes/{id}/scoped_kubeconfig). A scoped kubeconfig is read-only, limited to chosen namespaces within the caller's own access, expires after at most 7 days, and includes secrets only when requested. Its use is recorded in the activity log as (via scoped kubeconfig )

Added * and ? wildcards to excluded images in Docker image cleanup policies. The excluded-image badge now reads "Docker Hub or local", since names without a registry host also match locally built images

Added a link from add-on management to the add-on requirements FAQ, and made its warnings and status messages clearer. A failed uninstall now shows as "Uninstall failed" instead of "Upgrade failed" and can be retried

Added automatic recovery when the cluster rejects a cached Kubernetes service account token: Portainer drops the cached token and retries the request once

Bug Fixes

Fixed the GitOps Sources page failing to load with "Object not found inside the database (bucket=workflows)" when a stack referenced a deleted workflow. Orphaned references are now skipped, and deleting a stack now unlinks it from its workflow in the same save

Fixed deleting a Kubernetes stack with a namespace leaving behind objects whose manifest names no namespace

Fixed Kubernetes Edge agents retrying removal of workload-less Edge stacks forever, which delayed new deployments and check-ins

Fix the issue where the Docker dashboard volume count excludes volumes that restricted users have access to

Fix the issue where the Async Edge dashboard includes container statistics for resources that Standard users cannot access

Fix the issue where Compose stack undeploy operations do not respect the overall deployment timeout or cancellation context

Fixed the default Unassigned environment group being renameable. It is now read-only, and a group that was already renamed can be reset to "Unassigned"

Fixed an issue where Git-based Helm edge stacks ignored their values files. Existing stacks will apply their configured values files on the next deployment

Fixed the Helm upgrade modal's chart source dropdown opening behind the modal

Fixed the date range picker in container logs and the Activity Logs filter opening behind the sidebar

Fixed the GitOps workflow wizard advising users to create an Edge group when groups exist but none match the deployment type. It now distinguishes "no Edge groups exist" from "Edge groups exist but none match this deployment type"

Fixed installed add-ons failing to launch after switching to a catalog that no longer lists them. An add-on that can't be reached now shows an "Add-on unavailable" page instead of sending restricted users into a redirect loop

Fixed the add-on catalog serving a cached copy for up to 10 minutes after an administrator saved a new catalog URL or pressed refresh or Retry. It now reloads right away

Original source

v2.0.1

Fixed

Stacks left in Error can be updated again (#147)

A stack whose deployment had failed refused every further apply, in a fraction of a second and without sending a request. The only way out was starting the stack by hand in the Portainer UI. Fixing the compose file and re-applying now recovers the stack. A deployment that this provider itself started and that fails is still reported as a failure.

portainer_stack_delete_by_name now works at all

Every call failed with 400 Invalid query parameter: namespace. Portainer requires a namespace query parameter that its API specification does not document, so the resource never sent it.

portainer_registry_connection now works at all

Every check failed with 400 Username and password are required. Portainer demands credentials for all registry types, including public ones, so the data source never reached the connection test it exists to run. GitHub registries (type = 8) are also accepted now; the type was capped at 7.

Action required

Both fixes add a required argument to something that could not have been in working use, so no running configuration changes behaviour - but configurations that reference these two will now fail at plan time until they are updated:

resource "portainer_stack_delete_by_name" "example" {
  name = "legacy-app"
  namespace = "legacy-apps" # new, required
  endpoint_id = 4
}

data "portainer_registry_connection" "example" {
  url = "registry.example.com"
  type = 3
  username = "robot" # new, required
  password = var.password # new, required
}

Original source

What's Changed

Feature

Introduced a configuration file to replace command-line flags #188

For more details, refer to these docs: configuration file, configuration API

The local-path-provisioner image is only imported into containerd when local-path storage is enabled #195

Systems that don't use local-path storage no longer need the image or a registry pull for it

Added ready-to-import Grafana dashboards for the metrics endpoint #202

For more details, refer to this docs

Fixes

Fixed pods being duplicated and side-loaded images being lost when KubeSolo restarts #199

Fixed KubeSolo on nftables-only hosts and hosts with a read-only /proc/sys #190

kube-proxy no longer flushes the host's ip nat nftables table on startup #191

Fixed installing on 32-bit ARM and RISC-V hosts #198

Chore

Bumped google.golang.org/grpc 1.82.1 -> 1.83.2 #189 #193

Bumped go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.35.0 -> 1.45.0 #196

Full Changelog: v1.2.0...v1.2.1

Original source

Release v2.0.0

Business Edition API coverage

This release roughly doubles what the provider can manage: 81 new resources and data sources covering the Business Edition API, alongside fixes for a stack deployment failure on Portainer 2.45 and a blocker that prevented Edge Agent environments from being created at all.

Nothing was removed or renamed. Every configuration valid on v1.35.0 is still valid, but read "Behaviour changes" before upgrading - one of them can replace an environment.

Behaviour changes

Edge Agent environments are replaced when their address changes. Portainer bakes the address into the edge key when the environment is created and never regenerates it, so an in-place update never actually took effect. Until now the provider emitted a warning and reported success, leaving the running agent on the old address. It now forces replacement instead, which issues a new edge key and means the agent has to be redeployed with it.

This only triggers for environment types 4 and 7, only when the address really changed, and not when the difference is the URL scheme alone. That last exclusion matters: Portainer normalises endpoint.URL down to the bare host, so environments created by older provider versions hold a scheme-less address in state and would otherwise be replaced on every apply.

Run terraform plan against your edge environments before upgrading.

Failed API calls that used to pass silently now fail. One internal HTTP helper returned the body of a 403 or a 500 as though it were data. Several resources then either stored an error page in state or reported a confusing parse failure. Those calls now fail with what the server actually said. An apply that appeared to succeed against a misconfigured or unauthorised Portainer may now stop and tell you why.

Webhooks still behave as before by default. Business Edition can move a webhook to another resource in place, keeping its token and every URL already handed out. That is available through the new reassign_on_change argument and is off by default, because Portainer CE has no reassign endpoint. Without it, changing resource_id or webhook_type replaces the webhook exactly as it always has.

Fixes

Creating a stack no longer fails with a 409 (#145). Portainer 2.45 deploys stacks asynchronously and holds a per-stack lock until the deploy finishes. The provider's follow-up call landed inside that window and was rejected, tainting a stack that had in fact deployed fine, so every subsequent apply destroyed and recreated it. The provider now waits for the deployment to settle first. A deployment that fails is reported as a failure rather than retried into a false success. Covers both standalone and swarm stacks.

Edge Agent environments can be created on Portainer 2.43 and newer again. Portainer rejects TLS outright for edge types, and the provider was sending the TLS fields unconditionally. They are now omitted for types 4 and 7. This retires the known issue from v1.35.0: tls_enabled = false is no longer needed.

portainer_endpoint_relations no longer clears what it was not asked to change. Portainer reads an empty array as "remove everything", so an unconfigured field was wiping an environment's tags or edge groups. Each field is now omitted unless it is set.

portainer_kubernetes_cluster reads again. Portainer's API specification types the dashboard response as a list while the server returns an object, and the mismatch took the whole data source down. Both shapes are now accepted.

portainer_user_api_key explains itself. Portainer accepts this call only from a session and only for the calling user's own account. With an API key it answered 401 Auth not supported, which said nothing useful. The provider now refuses before sending and names the arguments to use instead.

Credentials no longer reach diagnostics or state. Errors carried the full request URL, and one endpoint takes a service account key as a query parameter. Sensitive query parameters are now redacted from error messages, and the data sources that store a failure reason keep only what the server said.

New resources

• Add-on store: portainer_addon, portainer_addon_access, portainer_addon_config, portainer_addon_repair
• Omni / Talos: portainer_omni_cluster, portainer_omni_node_reboot
• GitOps: portainer_gitops_workflow
• Backup: portainer_backup_azure_settings, portainer_backup_azure_execute, portainer_backup_azure_restore, portainer_backup_local_settings, portainer_backup_local_run, portainer_backup_s3_restore
• Kubernetes: portainer_kubernetes_pod_security_rule, portainer_kubernetes_cluster_upgrade
• Alerting: portainer_alerting_rule_groups, portainer_alerting_rule_tiers
• Settings and security: portainer_settings_default_registry, portainer_settings_additional_functionality, portainer_ssrf_allowlist
• Environments and users: portainer_endpoint_trust, portainer_user_memberships_sync

New data sources

• Add-on store: portainer_addons, portainer_addon_chart_source
• Omni / Talos: portainer_omni_machines, portainer_omni_machine, portainer_omni_machine_logs, portainer_omni_talos_versions, portainer_omni_upgrade_status, portainer_omni_service_account
• Kubernetes storage: portainer_kubernetes_storage_classes, portainer_kubernetes_storage_class, portainer_kubernetes_persistent_volume_claims, portainer_kubernetes_persistent_volume_claim, portainer_kubernetes_volumes, portainer_kubernetes_volume
• Kubernetes workloads: portainer_kubernetes_cron_jobs, portainer_kubernetes_endpoints, portainer_kubernetes_service_account, portainer_kubernetes_application, portainer_kubernetes_resource_counts, portainer_kubernetes_gpu
• Kubernetes custom resources: portainer_kubernetes_custom_resource_definitions, portainer_kubernetes_custom_resource_definition, portainer_kubernetes_custom_resources, portainer_kubernetes_custom_resource
• Edge: portainer_edge_waiting_room, portainer_edge_mtls_ca_certificate, portainer_edge_mtls_certificate, portainer_endpoint_mtls_certificate, portainer_endpoint_mtls_certificate_error, portainer_edge_configuration_files, portainer_edge_stack_stagger_status, portainer_edge_update_schedule_info, portainer_edge_update_previous_versions, portainer_edge_update_schedules_active, portainer_agent_versions
• Identity: portainer_ldap_users, portainer_ldap_groups, portainer_ldap_admin_groups, portainer_ldap_login_test, portainer_user_namespaces, portainer_current_user_authorizations
• Observability and policy: portainer_alerting_connectivity, portainer_alerting_rule_environments, portainer_environment_logs, portainer_environment_metrics, portainer_policy_metadata, portainer_policy_conflicts, portainer_policy_observability_test
• Docker: portainer_docker_snapshot, portainer_docker_snapshot_containers, portainer_docker_snapshot_container, portainer_image_status
• Other: portainer_licenses_info, portainer_recommendations, portainer_auto_updates, portainer_stack_conversion, portainer_backup_azure_connection, portainer_gitops_repo_file_search, portainer_gitops_helm_values

Edge Stack from a Helm repository

portainer_edge_stack gained a helm_config block, a fourth deployment source alongside an inline file, an uploaded file and a git repository. Setting it deploys the stack from a Helm chart repository. Note that leaving chart_version unset lets Portainer resolve the newest published version at apply time, so pin it where that matters.

Deliberately not covered

Some endpoints exist in the API but do not belong in Terraform, and are left out on purpose rather than overlooked:

• The add-on store's own configuration API (/addon-store/v1/*) and the edge configuration state endpoint. Both are called by an add-on or an agent reporting its own progress. Terraform is neither, and writing to them would falsify the rollout state.
• Deleting Kubernetes custom resources and custom resource definitions. The API offers no way to create them, so a resource that could only delete what something else made has no lifecycle Terraform can manage. Apply manifests with portainer_kubernetes_manifest instead.
• Cancelling an Omni provision in flight. It is an interactive escape hatch; Terraform's answer to a provision that will not finish is to destroy the resource.
• Websocket endpoints, CSV exports, the support bundle and /system/update.

Known limitations

The Business Edition resources have not been exercised against a live Business Edition instance. Their tests are built from Portainer's published API specification and verify the shape of every request, not the server's behaviour. CI runs Community Edition, so it cannot cover them either. Treat the first apply of a Business Edition resource as the real test, and please report anything that does not match.

portainer_omni_cluster cannot detect drift in its machine list. Portainer reports a cluster's spec and status but not the machines it was built from, so a node removed outside Terraform will not appear in a plan.

portainer_kubernetes_pod_security_rule reads back only its switches. The list sections are normalised and reordered by Portainer, so reading them into state would make a stable configuration churn. They are driven entirely by the configuration.

portainer_user_api_key needs api_user and api_password. Portainer only lets a user create a key for themselves, from a session. A key for a user Terraform creates in the same configuration needs two separate applies.

Original source

Known issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

Podman environments aren't supported by auto-onboarding script

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Support for only CentOS 9, Podman 5 rootful

Changes

Hardened outbound requests against SSRF. Helm chart resolution and Git HTTP/HTTPS operations now go through the SSRF-aware transport, and the static rules that enforce this now match by type rather than by import alias, so an aliased import can no longer slip past them

Certificate-based authentication for Azure Blob backups is now disabled in FIPS mode

Added build-time static analysis that catches FIPS violations before they ship

Removed unused non-FIPS code paths from FIPS builds

Updated golang.org/x/mod to 0.40.0, fixing CVE-2026-56865 and CVE-2026-56864

Updated golang.org/x/crypto to 0.56.0, fixing CVE-2026-56854 (High), CVE-2026-78662 and CVE-2026-56855

Updated google.golang.org/grpc to 1.83.2, fixing CVE-2026-84304

Updated kubectl in the kubectl shell image to v1.37.0, which removes golang.org/x/net 0.49.0 entirely — fixing CVE-2026-39821 (Critical) along with 2 High and 5 Medium findings

Updated helm in the kubectl shell image to v4.2.4, taking golang.org/x/net to 0.56.0 and fixing CVE-2026-46600 (High)

Upgraded the Alpine packages in the kubectl shell image, taking openssl/libssl3 to 3.5.8-r0, libcurl to 8.22.0-r0 and jq to 1.8.2-r0. Clears 2 Critical findings (CVE-2026-63073 and CVE-2026-75803) plus 9 High, 11 Medium and 1 Low

Simplified the stat cards on the environment list

Renamed the GitOps “Edit git settings” button to “Edit stack settings”, which reflects what it actually changes

The --secret-key-name help text now documents the BE secret path as well as the CE one

Fixed the Swarm network list failing to render, showing “Cannot read properties of undefined (reading 'NodeRole')” and staying empty even after a network was created

Fixed the node details Applications section listing pods that are not running on that node

Fixed a registry personal access token continuing to be used after it was changed. The Helm registry cache is now flushed when credentials change

Fixed the Edge Updater status page failing to load because of a broken status sort

Added an info box to Edge stacks explaining that the GitOps source polling interval does not apply to them

Deprecated and removed features

Deprecated features

None

Removed features

None

Original source

Known issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

Podman environments aren't supported by auto-onboarding script

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Support for only CentOS 9, Podman 5 rootful

Changes

Upgraded the Go toolchain from 1.25.12 to 1.25.14 to address the following CVEs:

CVE-2026-39821

CVE-2026-56862

CVE-2026-56859

CVE-2026-56853

CVE-2026-33818

CVE-2026-56858

CVE-2026-56860

Upgraded golang.org/x/mod to 0.40.0 to address the following CVEs:

CVE-2026-56865

CVE-2026-56864

Upgraded golang.org/x/crypto to 0.55.0 in Portainer CE and compose-unpacker, which had lagged behind the other modules, to address GO-2026-6303

Upgraded kubectl in the kubectl shell image from 1.36.2 to 1.37.0, which is built with Go stdlib 1.26.6 and vendors golang.org/x/net 0.57.0, clearing 2 Critical findings (including CVE-2026-39821), 7 High and 7 Medium

Upgraded the Alpine packages in the kubectl shell image, moving openssl/libssl3 to 3.5.8-r0 and jq to 1.8.2-r0, clearing a further 9 High, 10 Medium and 1 Low findings

Fixed the Portainer updater reporting a container as healthy when its health-check command had never actually run, which could cause a failed upgrade to skip its rollback. The updater now waits for the exec session to complete before reading its exit code

Deprecated and removed features

Deprecated features

None

Removed features

None

Original source

Known Issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

kubectl port-forward fails with Portainer kubeconfig in some configurations

Known issues with Podman

Support for only CentOS 9, Podman 5 rootful

Auto onboarding a Podman environment defaults to “Standard” and not “Podman”

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Known issues with Talos clusters managed by Omni (BE only)

Loading Omni specific information in the Cluster Details view and configuring an existing Talos cluster is currently restricted to Portainer Admins. Environment Admins will get a forbidden error when attempting to do this. This only applies to Omni configuration, and does not affect authentication for any other functionality in the cluster

New in this release

Hardened outbound requests against SSRF. Helm chart resolution and Git HTTP/HTTPS operations now go through the SSRF-aware transport, and the static rules that enforce this now match by type rather than by import alias, so an aliased import can no longer slip past them

Certificate-based authentication for Azure Blob backups is now disabled in FIPS mode

Added build-time static analysis that catches FIPS violations before they ship

Removed unused non-FIPS code paths from FIPS builds

Updated golang.org/x/mod to 0.40.0, fixing CVE-2026-56865 and CVE-2026-56864

Updated golang.org/x/crypto to 0.56.0, fixing CVE-2026-56854 (High), CVE-2026-78662 and CVE-2026-56855

Updated google.golang.org/grpc to 1.83.2, fixing CVE-2026-84304 (High, 8.7)

Updated kubectl in the kubectl shell image to v1.37.0, which removes golang.org/x/net 0.49.0 entirely — fixing CVE-2026-39821 (Critical) along with 2 High and 5 Medium findings

Updated helm in the kubectl shell image to v4.2.4, taking golang.org/x/net to 0.56.0 and fixing CVE-2026-46600 (High)

Upgraded the Alpine packages in the kubectl shell image, taking openssl / libssl3 to 3.5.8-r0, libcurl to 8.22.0-r0 and jq to 1.8.2-r0. Clears 2 Critical findings (CVE-2026-63073 and CVE-2026-75803) plus 9 High, 11 Medium and 1 Low

Simplified the stat cards on the environment list

Renamed the GitOps “Edit git settings” button to “Edit stack settings”, which reflects what it actually changes

The --secret-key-name help text now documents the BE secret path as well as the CE one

Fixed the Swarm network list failing to render, showing “Cannot read properties of undefined (reading 'NodeRole')” and staying empty even after a network was created

Fixed the node details Applications section listing pods that are not running on that node

Fixed a registry personal access token continuing to be used after it was changed. The Helm registry cache is now flushed when credentials change

Fixed the Edge Updater status page failing to load because of a broken status sort

Added an info box to Edge stacks explaining that the GitOps source polling interval does not apply to them

Fixed the initial setup screen leaving the S3 host field enabled in FIPS mode

Fixed automatic Edge environment creation bypassing the FIPS environment gate

FIPS-blocked registry types now return consistent HTTP status codes instead of differing by registry type

Updated github.com/google/cel-go to 0.30.0, fixing GHSA-gcjh-h69q-9w9g

Fixed alert notifications not being sent after an upgrade from 2.40, caused by a stale default receiver breaking Alertmanager config sync

Fixed add-on installation failing when no local Kubernetes environment is connected

Original source

What's Changed

• fix(deploy): check for duplicate stack and ingress names [C9S-391] by @cararyan-portainer in #94
• feat(deploy): give app Ingresses a tls: block when a wildcard secret exists [PLA-955] by @yajith in #97
• feat(deploy): add the access annotation Pomerium-fronted apps need to be reachable [PLA-947] by @yajith in #99
• fix(mcp): use unprivileged nginx image for static sites [FR-1209] by @nathanpeck in #88
• refactor(runtimes): single shared runtime catalogue for all deploy paths [FR-1209] by @nathanpeck in #89
• feat(applications): rebuild the list on DataTable, add breadcrumb app switcher by @nathanpeck in #90
• chore(design-system): bump to 0c89713, singular countLabel on the applications table by @nathanpeck in #100

New Contributors

• @cararyan-portainer made their first contribution in #94

Full Changelog: 1.3.1...1.3.2

Original source

Release v1.35.0

Support for Portainer 2.45.0 LTS, full coverage of the Portainer API, and two Edge Agent fixes.

The provider grows from 120 to 172 resources and data sources.

Portainer 2.45 support

2.45 introduced native Portainer APIs for Kubernetes alongside the kube-apiserver proxy. An audit of every route between 2.44.0 and 2.45.0 found the API delta is confined to the Kubernetes handler; everything else that changed upstream is internal refactoring with no payload change.

New resources:

• portainer_kubernetes_node_drain - drain a node with all six kubectl drain options (force, timeout, grace period, ignore DaemonSets, delete emptyDir data, disable eviction)
• portainer_kubernetes_deployment_scale - manage a deployment's replica count, with drift detection
• portainer_kubernetes_deployment_rollback - roll a deployment back to an earlier revision
• portainer_kubernetes_persistent_volume - pin a PersistentVolume's reclaim policy

New data sources: portainer_kubernetes_manifest_dry_run (validate manifests server-side before anything is applied), portainer_kubernetes_ingress_classes, portainer_kubernetes_resource_quotas, portainer_kubernetes_replicasets, portainer_kubernetes_deployments, portainer_kubernetes_pods, portainer_kubernetes_pod_logs.

Existing Kubernetes resources keep using the kube-apiserver proxy, so nothing changes for users on older Portainer versions.

GitOps

GitOps Sources & Workflows was the largest gap in API coverage - an entire Portainer feature with nothing but two repository helpers reachable from Terraform. Now covered by portainer_gitops_source (full lifecycle plus import) and five data sources: portainer_gitops_source, portainer_gitops_sources, portainer_gitops_workflow, portainer_gitops_workflows and portainer_gitops_source_connection.

Edge Agent fixes

edge_id is no longer empty (#142). Portainer only assigns an Edge ID at creation while the EnforceEdgeID setting is on; otherwise it stays empty until an agent connects, so there was nothing to template PORTAINER_EDGE_ID from and the agent could not be deployed from Terraform at all. The provider now generates one at create time, exactly as Portainer's own UI wizard does, and Portainer adopts it when the agent first checks in.

environment_address no longer drifts (#136). Portainer stores an edge endpoint's URL as a bare host, dropping the scheme, the port and the path, so http://portainer:9000 came back as portainer and showed a change on every plan. The address is now recovered from the edge key, which keeps it verbatim.

Editing the address of an existing Edge Agent environment now warns instead of looking like a successful apply: Portainer bakes it into the edge key at creation and never regenerates it, so the resource has to be replaced.

Known issues

Two things to be aware of when managing Edge Agent environments. Neither is new in this release.

Creating an Edge Agent environment needs tls_enabled = false on Portainer 2.43 and newer. Portainer rejects the request with TLS is not supported for Edge Agent environments, because the provider sends the TLS flags on create and tls_enabled defaults to true. Set it explicitly until this is fixed:

resource "portainer_environment" "edge" {
name = "edge-device"
environment_address = "https://portainer.example.com"
type = 4
tls_enabled = false # required on Portainer >= 2.43
}

Changing environment_address on an existing Edge Agent environment does not converge. The apply warns and the plan keeps showing the change, because Portainer bakes the address into the edge key at creation and the provider reads it back from there. Replace the environment (terraform apply -replace=...) to move it, then redeploy the agent with the new edge key.

Complete API coverage

Every path in Portainer 2.45's API is now reachable, except fifteen left out by design: interactive websocket streams, edge-agent-facing polling endpoints, binary upload into a container, session and auth flows, the host upgrade, bulk environment delete, the edge stack status an agent reports, and the multipart stack create that the existing string variant already covers.

Closing the remaining gaps added, among others:

• portainer_user_api_key - API keys can finally be revoked and rotated, not only created
• portainer_endpoint_group_membership - place a single environment in a group
• portainer_registry_configure and portainer_registry_connection - registry configuration and a pre-flight reachability check
• portainer_ldap_check - validate LDAP settings before committing them
• portainer_restore - the counterpart of portainer_backup
• portainer_endpoint_relations, portainer_stack_delete_by_name, portainer_edge_job_task_logs
• portainer_resource_control can now create a control, which makes every resource type other than stacks usable
• Read-only data sources for the instance itself (portainer_system, portainer_settings_public, portainer_motd), access auditing (portainer_user_access, portainer_team_memberships), the Kubernetes cluster (portainer_kubernetes_cluster, _nodes, _events, _describe, _persistent_volumes, _config, _pod_metrics, _node_metrics, _application_resources), Docker (portainer_docker_dashboard, _images, _container_gpus), templates (portainer_app_templates, portainer_helm_chart), stored files and portainer_endpoints_summary

portainer_system.server_version is the one to reach for if you need to gate configuration on the Portainer release - several of the resources above require 2.45 or newer.

Notes on sensitive data

Two of the new data sources touch credentials, and both are deliberate about it:

• portainer_kubernetes_config returns a kubeconfig carrying a bearer token for the calling user. It is marked sensitive, but it still lands in Terraform state.
• portainer_endpoint_registries does not expose the password or access token that Portainer returns with every registry object, on purpose.

Maintenance

Go 1.27 (from 1.26). Building from source now needs Go 1.27+; the released binaries are unaffected.

go-openapi/runtime 0.32.1 → 0.33.1, go-openapi/strfmt 0.26.2 → 0.27.0, plus 25 indirect modules, picking up their CVE fixes. terraform-plugin-sdk/v2 and portainer/client-api-go/v2 were already current.

Contributors: make lint now installs golangci-lint v2 (pinned to v2.13.2) and .golangci.yml is in the v2 format. The v1 line cannot read Go 1.27 export data.

Original source

Known issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

Podman environments aren't supported by auto-onboarding script

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Support for only CentOS 9, Podman 5 rootful

Changes

New and improved features

Added advanced Kubernetes node drain options with agent failover

Added native Portainer APIs for writing Kubernetes secrets, configmaps, deployments and persistent volume claims, replacing direct kube-apiserver proxy calls

Added a generic Kubernetes manifest dry-run API

Edge Compute settings can now be configured during initial setup and via cli flags

Authentication events now record the real client IP from X-Forwarded-For when the request comes through a trusted proxy

The namespace YAML tab now shows every resource quota in the namespace

Added GetCharts() support to the async Edge agent, so chart data syncs on agent startup

Edge agent connectivity checks now report progress while probing, and wait longer before failing

Creating a git source now skips the source type selection step

The source form now explains git polling versus webhook triggers, and exposes the polling interval setting that was missing from the UI

Removed the redundant single-tab handle from the workflow details view

Reworded the registry creation tooltip to make the default behaviour obvious

Clarified that Portainer supports Podman through its Docker-compatible API only

Security improvements

Fixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly

Closed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments

Single-namespace Kubernetes endpoints now check the caller’s namespace authorization instead of running as admin

Read-only and Helpdesk users can no longer view Kubernetes secret data

Standard users can no longer manage registry access

Kubernetes authorization denials now return HTTP 403 instead of 500

Fixed a Kubernetes shell authorization flaw. Caller-supplied query parameters could override the server's pod target, letting a standard user run commands in any pod on Agent-managed Kubernetes environments

Updated the Go toolchain to 1.26.6, fixing CVE-2026-39821 (Critical, 9.6), an IDNA validation bypass of hostname-based access controls, along with CVE-2026-42505, CVE-2026-39822, CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, CVE-2026-56858, CVE-2026-56853, CVE-2026-46600 and CVE-2026-33818

Updated oras.land/oras-go/v2 to 2.6.2, fixing CVE-2026-50163

Updated github.com/go-git/go-git/v5 to 5.19.2, fixing CVE-2026-71556 and CVE-2026-71557

Updated go.opentelemetry.io/otel to 1.44.0, fixing CVE-2026-41178

Updated github.com/klauspost/compress to 1.18.7, fixing GHSA-259r-337f-4rfw

Upgraded libcurl to 8.21.0-r0 in the kubectl-shell image to address the following CVEs: CVE-2026-11856, CVE-2026-10536, CVE-2026-11564, CVE-2026-12064, CVE-2026-11586, CVE-2026-11352, CVE-2026-9547, CVE-2026-9546, CVE-2026-9545, CVE-2026-9080, CVE-2026-9079, CVE-2026-8932, CVE-2026-8927, CVE-2026-8926, CVE-2026-8925, CVE-2026-8924, CVE-2026-8458, and CVE-2026-8286.

Upgraded c-ares to 1.34.8-r0 in the kubectl-shell image to address CVE-2026-33630

Bug fixes

Removing a stack now uninstalls the underlying Helm release, which used to be left running

Fixed Edge stack workloads staying up after deletion on Kubernetes. The entry file and namespace are now sent on removal

Fixed collisions during Edge stack removal and reassignment. The old stack is now removed before the new one deploys

Fixed Lstat /data/edge_stacks/<id>/v1: no such file or directory on Kubernetes async agents by persisting the artifact commit hash before creating the Edge stack

Fixed Azure Blob backup settings not saving, by resolving redacted credentials on write

Fixed manual team-membership sync diverging from login-time sync by sharing a single implementation

Fixed server-managed API key metadata fields being wiped on policy update

Fixed spaces in setup policy names causing Kubernetes label errors

Fixed the Policies card on the Kubernetes dashboard not counting all applied policy types

Policy operations now return a meaningful error when the policy isn’t found, instead of a bare 404

Fixed the Edit button being disabled for a Helm chart stack deployed from GitHub

Fixed the browser title bar staying stuck on “Loading” after a page refresh

Fixed multiple error toasts appearing for a metrics time range over 31 days, and stopped the request over-retrying

Fixed alert modal validation desyncing from the input

Fixed the “Open in OneUptime” navigation using an incorrect URL

Fixed the Uninstall button being enabled in the add-on list but disabled in the detail view while an install was running

The Restart button is no longer shown for failed add-on installs

Deprecated and removed features

Deprecated features

None.

Removed features

None

Community contributions since 2.39.0 LTS

A huge thank you to all our community contributors.

This LTS release rolls up work from the 2.40 to 2.44 STS releases, including fixes and improvements contributed by these community members:

Nguyen Quang Minh (@minhng99) - corrected the OAuth scope placeholder format

Zach (@zacxihu) - relative env_file: paths now resolve against the compose file's directory, fixing Git sub-directory stacks

Rian Moraes (@rshmdev) - env var descriptions now shown as tooltips in application templates

Siddam Vinay (@siddamvinay2001) - truncated published-port lists with a show-more badge, and made early async Swarm deploy failures surface instead of reporting success

Immanuel Tikhonov (@immanuwell) - fixed a registry cache type mismatch that meant the cache never hit

@ferreiraborgesaxel-design - fixed reversed markdown link syntax in the contributing docs

Ion Jaureguialzo Sarasola (@ijaureguialzo) - fixed a Kubernetes crash on malformed web-editor manifests

Du Feilong (@dfldylan) and Jerry (@jerry-yuan) - added Docker --security-opt support and Swarm cluster self-heal after manager reap

SRIKANTH K (@srikanth-karthi) - Portainer now tolerates malformed OAuth Content-Type headers from resource endpoints

Original source

Known issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

Podman environments aren't supported by auto-onboarding script

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Support for only CentOS 9, Podman 5 rootful

Changes

Fixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly

Closed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments

Deprecated and removed features

Deprecated features

None

Removed features

None

Original source