k3s-io/k3s v1.25.7+k3s1

on GitHub

This release updates Kubernetes to v1.25.7, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.25.6+k3s1:

• Add jitter to scheduled snapshots and retry harder on conflicts (#6782)
  • Scheduled etcd snapshots are now offset by a short random delay of up to several seconds. This should prevent multi-server clusters from executing pathological behavior when attempting to simultaneously update the snapshot list ConfigMap. The snapshot controller will also be more persistent in attempting to update the snapshot list.
• Bump cri-dockerd (#6798)
  • The embedded cri-dockerd has been updated to v0.3.1
• Bugfix: do not break cert-manager when pprof is enabled (#6837)
• Wait for cri-dockerd socket (#6853)
• Bump vagrant boxes to fedora37 (#6858)
• Fix cronjob example (#6864)
• Ensure flag type consistency (#6867)
• Consolidate E2E tests (#6887)
• Ignore value conflicts when reencrypting secrets (#6919)
• Use default address family when adding kubernetes service address to SAN list (#6904)
  • The apiserver advertised address and IP SAN entry are now set correctly on clusters that use IPv6 as the default IP family.
• Allow ServiceLB to honor ExternalTrafficPolicy=Local (#6907)
  • ServiceLB now honors the Service's ExternalTrafficPolicy. When set to Local, the LoadBalancer will only advertise addresses of Nodes with a Pod for the Service, and will not forward traffic to other cluster members.
• Fix issue with servicelb startup failure when validating webhooks block creation (#6916)
  • The embedded cloud controller manager will no longer attempt to unconditionally re-create its namespace and serviceaccount on startup. This resolves an issue that could cause a deadlocked cluster when fail-closed webhooks are in use.
• Backport user-provided CA cert and kubeadm bootstrap token support (#6929)
  • K3s now functions properly when the cluster CA certificates are signed by an existing root or intermediate CA. You can find a sample script for generating such certificates before K3s starts in the github repo at contrib/util/certs.sh.
  • K3s now supports kubeadm style join tokens. k3s token create now creates join token secrets, optionally with a limited TTL.
  • K3s agents joined with an expired or deleted token stay in the cluster using existing client certificates via the NodeAuthorization admission plugin, unless their Node object is deleted from the cluster.
• Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent (#6936)
  • Fixed an issue that would cause the apiserver egress proxy to attempt to use the agent tunnel to connect to service endpoints even in agent or disabled mode.
• Updated flannel version to v0.21.1 (#6915)
• Allow for multiple sets of leader-elected controllers (#6941)
  • Fixed an issue where leader-elected controllers for managed etcd did not run on etcd-only nodes
• Fix etcd and ca-cert rotate issues (#6954)
• Fix ServiceLB dual-stack ingress IP listing (#6987)
  • Resolved an issue with ServiceLB that would cause it to advertise node IPv6 addresses, even if the cluster or service was not enabled for dual-stack operation.
• Bump kine to v0.9.9 (#6975)
  • The embedded kine version has been bumped to v0.9.9. Compaction log messages are now omitted at info level for increased visibility.
• Update to v1.25.7-k3s1 (#7010)

Embedded Component Versions

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here