⚠️ Upgrade Notes
- The migration plan auditor now blocks standalone server-network detachment and flags in-place private/public networking changes. A plan with no server replacement is not sufficient proof of IP/MAC preservation, guest routing, or quorum-safe rollout. The underlying v2 attachment migration and existing-cluster NAT transitions still require separate operator review (#2277, #2283).
- Cilium users migrating from v2 must compare effective kube-proxy replacement, BPF masquerading, and tunnel settings. Unchanged inputs can change those settings in v3; changing
enable_kube_proxyalone does not restart existing K3s agents. Current v3 defaults are unchanged (#2287, #2288).
🚀 New Features
- Accept the v1.36 channel for K3s and RKE2 without changing defaults; explicitly approved for inclusion in 3.2.1 (#2276; thanks @steache).
🐛 Bug Fixes
- Refresh both reviewed MicroOS appliance digests after the publisher rotated its rolling images. Independent signature, artifact-identity and complete-image checks preserve fail-closed verification for new snapshot builds.
- Allow slow Leap Micro and MicroOS appliance downloads with separate DNS/connect/read timeouts and sanitized failure diagnostics, preserving signatures, digest pins, and mirror authentication safeguards (#2284; thanks @clemlesne).
- Detect network attachment deletion and in-place server networking risks in saved migration plans, including unknown planned values (#2277, #2283; thanks @robsumoza and @clemlesne).
- Warn about Cilium datapath migration even when the scanner finds no legacy inputs; add device-versus-route MTU diagnostics without changing runtime MTU defaults (#2286, #2287, #2288; thanks @ChrisKretschmer).
📚 Documentation
- Clarify HAProxy's required PROXY-protocol transport peers and replace misleading CDN-range examples with exact-peer diagnostics. Trusted networks and ingress defaults are unchanged (#2288; thanks @ChrisKretschmer).
- Warn that changing
ssh_portalone does not migrate existing listeners and may interrupt management access; document recovery limits for mixed fleets and NAT routers (#2285; thanks @clemlesne). - Clarify that NAT redundancy provides active/standby failover, not additional egress capacity, and explain
nopreemptrecovery behavior (#2281; thanks @clemlesne).
What's Changed
Other Changes
- docs: finalize v3.2.0 release documentation by @mysticaltech in #2275
- fix: prepare v3.2.1 download and migration safeguards by @mysticaltech in #2289
- fix: integrate v1.36 channel support for 3.2.1 by @mysticaltech in #2290
- feat: accept v1.36 for k3s_channel and rke2_channel by @steache in #2276
- test: run HAProxy protocol regression in cheap CI by @mysticaltech in #2291
New Contributors
Full Changelog: v3.2.0...v3.2.1