Update rancher/rancher Docker tag to v2.12.2 #265
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/rancher-rancher-2.x
branch
from
b9d1b21 to
65b4fb9
Compare
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.12.0->v2.12.2Release Notes
rancher/rancher (rancher/rancher)
v2.12.2Compare Source
Release v2.12.2
Rancher v2.12.2 is the latest patch release of Rancher. This is a Community and Prime version release that introduces maintenance updates and bug fixes. To learn more about Rancher Prime, see our page on the Rancher Prime Platform.
For more information on new features in the general minor release see the v2.12.0 release notes.
Changes Since v2.12.1
See the full list of changes.
Security Fixes for Rancher Vulnerabilities
This release addresses the following Rancher security issues:
Manage Userspermission could potentially deny any user, including admins, from logging in. To prevent this, usernames have been made immutable once set, and it is not possible to update or create a user with a username that is already in use. For more information, refer to CVE-2024-58260.requestIdmore visibly than as part of the login URL. It also adds acli=trueorigin marker to the URL. The dashboard is modified to recognize the presence of therequestIdand uses that to show a warning message to the user, asking for verification that they initiated a CLI login with the related Id. The non-presence of the origin marker enables the dashboard to distinguish between the modified CLI and older CLI’s, and adjust the message accordingly. For more information, refer to CVE-2024-58267.Impersonate-*headers are removed for requests made through the/meta/proxyRancher endpoint (e.g. when cloud credentials are being created) as the headers may contain identifiable and/or sensitive information. For more information, refer to CVE-2025-54468.For more details, see the Security Advisories and CVEs page in Rancher's documentation or in Rancher's GitHub repo.
Rancher General
Known Issues
Rancher Webhook
Major Bug Fixes
Install/Upgrade Notes
Changes in Image Artifacts
Image artifact digests are renamed in Rancher v2.12.0, v2.11.4 and v2.10.8. Up until this change, separate image digests files for each operating system and architecture have been maintained for compatibility reasons. With this change, only one file for each operating system is to be provided:
rancher-images-digests-linux-amd64.txtandrancher-images-digests-linux-arm64.txtfiles are to be renamed torancher-images-digests-linux.txt.rancher-images-digests-windows-ltsc2019.txtandrancher-images-digests-windows-ltsc2022.txtfiles are to be renamed torancher-images-digests-windows.txt.Upgrade Requirements
NO_PROXY. See the documentation and issue #2725.registries.yamlfile to thedocker runcommand, as shown in the K3s documentation. If the registry has certificates, then you'll also need to supply those. See #28969.privilegedflag. See documentation.Versions
Please refer to the README for the latest and stable Rancher versions.
Please review our version documentation for more details on versioning and tagging conventions.
Images
Tools
Kubernetes Versions for RKE2/K3s
Rancher Helm Chart Versions
In Rancher v2.6.0 and later, in the Apps & Marketplace UI, many Rancher Helm charts are named with a major version that starts with 100. This avoids simultaneous upstream changes and Rancher changes from causing conflicting version increments. This also complies with semantic versioning (SemVer), which is a requirement for Helm. You can see the upstream version number of a chart in the build metadata, for example:
100.0.0+up2.1.0. See #32294.Previous Rancher Behavior Changes
Previous Rancher Behavior Changes - Rancher General
Kubernetes v1.30 is no longer supported. Before upgrading to Rancher v2.12.0, ensure all clusters are running Kubernetes v1.31 or later. See #49679.
The feature flag
ui-sql-cache(Server-Side Pagination) is now enabled by default in Rancher. Please refer to the UI Server-Side Pagination document for more information.Beginning with Rancher v2.12.0, UI Server-Side Pagination is enabled by default to provide significant performance improvements across the Rancher UI. This feature relies on a caching mechanism that introduces a new requirement for ephemeral disk space on your cluster nodes.
This cache, an internal SQLite database, is stored within the container's filesystem. This affects the nodes running the Rancher server pods (rancher in the cattle-system namespace on the local cluster) and the nodes running the Rancher agent pods (cattle-cluster-agent in the cattle-system namespace on all downstream clusters).
The amount of disk space required is dynamic and depends on the quantity and size of Kubernetes resources visualized in the UI. As a guideline, the cache may consume approximately twice the size of the raw Kubernetes objects it stores. For instance, internal tests showed that caching 5000 ConfigMaps, totaling 50 MB, consumed 81 MB of disk space. For a conservative, high-level estimate, you can plan for the available disk space on each relevant node to be at least twice the size of your etcd snapshot. For most production environments, ensuring a few extra gigabytes of storage are available on the relevant nodes is a safe starting point.
It is crucial that you review the available disk space on your nodes and plan accordingly before upgrading to this version to avoid potential disk pressure and pod eviction issues.
This update has introduced limitations which are outlined in the UI Server Side Pagination documentation. See #48691 and #12975 for more information.
Previous Rancher Behavior Changes - Logging
AUDIT_LOG_ENABLEDfor API Audit Logs for a Rancher installation. In Rancher versions 2.11.x and earlier, only theAUDIT_LEVELcould be set and the default log level (0) would disable the audit log. In Rancher versions 2.12.x and later, the default log level (0) now only contains the log request and response metadata, and can be set when configuringAUDIT_LOG_ENABLED. If installing or upgrading via Helm you can enable the API Audit Logs and specify the log level by applying the following setting to your Helm command:--set auditLog.enabled=true --set auditLog.level=0. See the Enabling the API Audit Log to Record System Events documentation and #48941.Previous Rancher Behavior Changes - Cluster Provisioning
Rancher's
system-upgrade-controllerapp is now managed by thesystemcharthandler in downstream provisioned RKE2/K3s clusters. For additional information refer to this comment and see #47737.Rancher v2.12.0 introduces changes in Custom Resource Definition (CRD) validations for
dynamicschemas.management.cattle.ioand dynamically generated CRDs:DynamicSchema
dynamicschemas.management.cattle.ioThis CRD had a generic schema that allowed any field to be set. It has been updated to only allow the expected fields.
This is not a user-facing CRD and is used internally by rancher.
InfrastructureMachine CRDs
These are the CAPI InfrastructureMachine CRDs defined for the Rancher Cluster API (CAPI) infrastructure provider. They are dynamically generated and are named
<name>machines.rke-machine.cattle.io, where<name>is derived from the node driver used to provision machines with a given infrastructure provider. Each active node driver has an associated InfrastructureMachine CRD.InfrastructureMachine objects are generated automatically by Rancher from other configuration objects.
The following validations were changed in this CRD schema:
spec.common.cloudCredentialSecretName<namespace>:<secretname>).spec.common.labelsnullvalue.spec.common.taints, in each taint object:effectandkeyare now required.timeAddedis now required to be in thedate-timeformat.nullvalue.status.addresses, in each address object:addressandtypeare now required and are no longer allowed to take anullvalue.typemust take one of the following values:Hostname,ExternalIP,InternalIP,ExternalDNSorInternalDNS.addressmust be between 1 and 256 characters long.status.conditions, in each condition object:statusandtypeare now required.nullvalue anymore.statusnullvalue anymore.InfrastructureMachineTemplate CRDs
These are the CAPI InfrastructureMachineTemplate CRDs defined for the Rancher CAPI infrastructure provider. They are dynamically generated and are named
<name>machinetemplates.rke-machine.cattle.io, where<name>is derived from the node driver used to provision machines with a given infrastructure provider. Each active node driver has an associated InfrastructureMachineTemplate CRD.InfrastructureMachineTemplate objects are generated automatically by Rancher from other configuration objects.
spec.template.spec.common.cloudCredentialSecretName<namespace>:<secretname>).spec.template.spec.common.labelsnullvalue.spec.template.spec.common.taints, in each taint object:effectandkeyare now required.timeAddedis now required to be in thedate-timeformat.nullvalue anymore.See #49402 for more information.
Previous Rancher Behavior Changes - Continuous Delivery (Fleet)
rancher/kubectlis no longer needed. See fleet#3601.Long-standing Known Issues
Long-standing Known Issues - Cluster Provisioning
Not all cluster tools can be installed on a hardened cluster.
Rancher v2.12.1:
Rancher v2.8.1:
[ERROR] 000 received while downloading Rancher connection information. Sleeping for 5 seconds and trying again. As a workaround, you can unpause the cluster by runningkubectl edit clusters.cluster clustername -n fleet-defaultand setspec.unpausedtofalse. See #43735.Rancher v2.7.2:
Long-standing Known Issues - RKE2 Provisioning
Activestatus after a migration. If you see that a downstream cluster is still updating or in an error state immediately after a migration, please let it attempt to resolve itself. This might take up to an hour to complete. See #34518 and #42834.Long-standing Known Issues - K3s Provisioning
Updatingstate even when they contain nodes in anErrorstate. See #39164.Long-standing Known Issues - Rancher App (Global UI)
Cannot read properties of undefined.... As a workaround, standard users must manually add their cloud credentials to create, edit, and manage Azure or AKS clusters. See #15241._in theCluster Namefield. See #9416.Long-standing Known Issues - Hosted Rancher
Long-standing Known Issues - EKS
Long-standing Known Issues - Authentication
[projectroletemplatebindings.management.cattle.io](http://projectroletemplatebindings.management.cattle.io/) is forbidden: User "u-gcxatwsnku" cannot create resource "projectroletemplatebindings" in API group "[management.cattle.io](http://management.cattle.io/)" in the namespace "p-9t5pg". However, the project is still created. See #46106.Long-standing Known Issues - Rancher Webhook
Long-standing Known Issues - Virtualization Management (Harvester)
Long-standing Known Issues - Backup/Restore
When migrating to a cluster with the Rancher Backup feature, the server-url cannot be changed to a different location. It must continue to use the same URL.
Rancher v2.7.7:
Activestatus after a migration. If you see that a downstream cluster is still updating or in an error state immediately after a migration, please let it attempt to resolve itself. This might take up to an hour to complete. See #34518 and #42834.v2.12.1Compare Source
Release v2.12.1
Rancher v2.12.1 is the latest patch release of Rancher. This is a Community and Prime version release that introduces maintenance updates and bug fixes. To learn more about Rancher Prime, see our page on the Rancher Prime Platform.
Changes Since v2.12.0
See the full list of changes.
Security Fixes for Rancher Vulnerabilities
This release addresses the following Rancher security issues:
CATTLE_AUTH_API_BODY_LIMITto a quantity, e.g., 2 Mi, which would allow larger payloads for the authentication endpoints. For more information, see CVE-2024-58259.fleet.yamlwith your directory name (e.g.,my-dir/values.yamlinstead ofvalues.yaml) would not be excluded, which would potentially expose confidential data in bundle resources. Helm values files are now excluded from bundle resources regardless of how you reference them. For more information, see CVE-2023-32198.For more details, see the Security Advisories and CVEs page in Rancher's documentation or in Rancher's GitHub repo.
Rancher General
Features and Enhancements
Known Issues
scc-operatorimage tag v0.1.0 used to register Rancher Manager with the SCC. To resolve this bug a new image tag v0.1.2 for thescc-operator-imagesettingwas created which includes a fix to patch v2.12.1. Run the followingkubectlcommand to patch the Ranchersettingwith the updated image:kubectl patch setting scc-operator-image --type=merge -p '{"value":"rancher/scc-operator:v0.1.2"}'Rancher App (Global UI)
Known Issues
Cannot read properties of undefined.... As a workaround, standard users must manually add their cloud credentials to create, edit, and manage Azure or AKS clusters. See #15241.Cluster Provisioning
Known Issues
Major Bug Fixes
activeinitially, but then the cluster state continuously toggles betweenactiveandupdating. See #51487.Install/Upgrade Notes
Changes in Image Artifacts
Image artifact digests are renamed in Rancher v2.12.0, v2.11.4 and v2.10.8. Up until this change, separate image digests files for each operating system and architecture have been maintained for compatibility reasons. With this change, only one file for each operating system is to be provided:
rancher-images-digests-linux-amd64.txtandrancher-images-digests-linux-arm64.txtfiles are to be renamed torancher-images-digests-linux.txt.rancher-images-digests-windows-ltsc2019.txtandrancher-images-digests-windows-ltsc2022.txtfiles are to be renamed torancher-images-digests-windows.txt.Upgrade Requirements
NO_PROXY. See the documentation and issue #2725.registries.yamlfile to thedocker runcommand, as shown in the K3s documentation. If the registry has certificates, then you'll also need to supply those. See #28969.privilegedflag. See documentation.Versions
Please refer to the README for the latest and stable Rancher versions.
Please review our version documentation for more details on versioning and tagging conventions.
Images
Tools
Kubernetes Versions for RKE2/K3s
Rancher Helm Chart Versions
In Rancher v2.6.0 and later, in the Apps & Marketplace UI, many Rancher Helm charts are named with a major version that starts with 100. This avoids simultaneous upstream changes and Rancher changes from causing conflicting version increments. This also complies with semantic versioning (SemVer), which is a requirement for Helm. You can see the upstream version number of a chart in the build metadata, for example:
100.0.0+up2.1.0. See #32294.Previous Rancher Behavior Changes
Previous Rancher Behavior Changes - Rancher General
Kubernetes v1.30 is no longer supported. Before upgrading to Rancher v2.12.0, ensure all clusters are running Kubernetes v1.31 or later. See #49679.
The feature flag
ui-sql-cache(Server-Side Pagination) is now enabled by default in Rancher. Please refer to the UI Server-Side Pagination document for more information.Beginning with Rancher v2.12.0, UI Server-Side Pagination is enabled by default to provide significant performance improvements across the Rancher UI. This feature relies on a caching mechanism that introduces a new requirement for ephemeral disk space on your cluster nodes.
This cache, an internal SQLite database, is stored within the container's filesystem. This affects the nodes running the Rancher server pods (rancher in the cattle-system namespace on the local cluster) and the nodes running the Rancher agent pods (cattle-cluster-agent in the cattle-system namespace on all downstream clusters).
The amount of disk space required is dynamic and depends on the quantity and size of Kubernetes resources visualized in the UI. As a guideline, the cache may consume approximately twice the size of the raw Kubernetes objects it stores. For instance, internal tests showed that caching 5000 ConfigMaps, totaling 50 MB, consumed 81 MB of disk space. For a conservative, high-level estimate, you can plan for the available disk space on each relevant node to be at least twice the size of your etcd snapshot. For most production environments, ensuring a few extra gigabytes of storage are available on the relevant nodes is a safe starting point.
It is crucial that you review the available disk space on your nodes and plan accordingly before upgrading to this version to avoid potential disk pressure and pod eviction issues.
This update has introduced limitations which are outlined in the UI Server Side Pagination documentation. See #48691 and #12975 for more information.
Previous Rancher Behavior Changes - Logging
AUDIT_LOG_ENABLEDfor API Audit Logs for a Rancher installation. In Rancher versions 2.11.x and earlier, only theAUDIT_LEVELcould be set and the default log level (0) would disable the audit log. In Rancher versions 2.12.x and later, the default log level (0) now only contains the log request and response metadata, and can be set when configuringAUDIT_LOG_ENABLED. If installing or upgrading via Helm you can enable the API Audit Logs and specify the log level by applying the following setting to your Helm command:--set auditLog.enabled=true --set auditLog.level=0. See the Enabling the API Audit Log to Record System Events documentation and #48941.Previous Rancher Behavior Changes - Cluster Provisioning
Rancher's
system-upgrade-controllerapp is now managed by thesystemcharthandler in downstream provisioned RKE2/K3s clusters. For additional information refer to this comment and see #47737.Rancher v2.12.0 introduces changes in Custom Resource Definition (CRD) validations for
dynamicschemas.management.cattle.ioand dynamically generated CRDs:DynamicSchema
dynamicschemas.management.cattle.ioThis CRD had a generic schema that allowed any field to be set. It has been updated to only allow the expected fields.
This is not a user-facing CRD and is used internally by rancher.
InfrastructureMachine CRDs
These are the CAPI InfrastructureMachine CRDs defined for the Rancher Cluster API (CAPI) infrastructure provider. They are dynamically generated and are named
<name>machines.rke-machine.cattle.io, where<name>is derived from the node driver used to provision machines with a given infrastructure provider. Each active node driver has an associated InfrastructureMachine CRD.InfrastructureMachine objects are generated automatically by Rancher from other configuration objects.
The following validations were changed in this CRD schema:
spec.common.cloudCredentialSecretName<namespace>:<secretname>).spec.common.labelsnullvalue.spec.common.taints, in each taint object:effectandkeyare now required.timeAddedis now required to be in thedate-timeformat.nullvalue.status.addresses, in each address object:addressandtypeare now required and are no longer allowed to take anullvalue.typemust take one of the following values:Hostname,ExternalIP,InternalIP,ExternalDNSorInternalDNS.addressmust be between 1 and 256 characters long.status.conditions, in each condition object:statusandtypeare now required.nullvalue anymore.statusnullvalue anymore.InfrastructureMachineTemplate CRDs
These are the CAPI InfrastructureMachineTemplate CRDs defined for the Rancher CAPI infrastructure provider. They are dynamically generated and are named
<name>machinetemplates.rke-machine.cattle.io, where<name>is derived from the node driver used to provision machines with a given infrastructure provider. Each active node driver has an associated InfrastructureMachineTemplate CRD.InfrastructureMachineTemplate objects are generated automatically by Rancher from other configuration objects.
spec.template.spec.common.cloudCredentialSecretName<namespace>:<secretname>).spec.template.spec.common.labelsnullvalue.spec.template.spec.common.taints, in each taint object:effectandkeyare now required.timeAddedis now required to be in thedate-timeformat.nullvalue anymore.See #49402 for more information.
Previous Rancher Behavior Changes - Continuous Delivery (Fleet)
rancher/kubectlis no longer needed. See fleet#3601.Long-standing Known Issues
Long-standing Known Issues - Cluster Provisioning
Not all cluster tools can be installed on a hardened cluster.
Rancher v2.12.0:
cluster.provisioning.cattle.ioobject fail to reconnect to Rancher. For a solution regarding affected imported clusters, please refer to this comment. Note that since v2.11.0 imported clusters are created viacluster.management.cattle.ioinstead, see release noted #13151. Additionally, creating custom resources directly is not an officially supported method of creating imported clusters. See #51066.Rancher v2.8.1:
[ERROR] 000 received while downloading Rancher connection information. Sleeping for 5 seconds and trying again. As a workaround, you can unpause the cluster by runningkubectl edit clusters.cluster clustername -n fleet-defaultand setspec.unpausedtofalse. See #43735.Rancher v2.7.2:
Long-standing Known Issues - RKE2 Provisioning
Activestatus after a migration. If you see that a downstream cluster is still updating or in an error state immediately after a migration, please let it attempt to resolve itself. This might take up to an hour to complete. See #34518 and #42834.Long-standing Known Issues - K3s Provisioning
Updatingstate even when they contain nodes in anErrorstate. See #39164.Long-standing Known Issues - Rancher App (Global UI)
_in theCluster Namefield. See #9416.Long-standing Known Issues - Hosted Rancher
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.