RKE2 - v1.29.3+rke2r1

This release updates Kubernetes to v1.29.3.

Important Notes

Canal uses flannel 0.24.3 which includes a bug: every 5 seconds it tries to add ipv6 iptables rules and fails if the node does not have an ipv6 address. The consequence is the log "Failed to ensure iptables rules: error setting up rules: failed to apply partial iptables-restore unable to run iptables-restore (, ): exit status 4" appears every 5 seconds in the flannel container of the canal pod.

Flannel daemonset is not tolerating node taints: "node-role.kubernetes.io/etcd:NoExecute", "node-role.kubernetes.io/control-plane:NoSchedule" and "node.cloudprovider.kubernetes.io/uninitialized:NoSchedule" which can create problems when deploying with Rancher in certain cloud-providers (e.g. vShpere or DigitalOcean).

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.29.2+rke2r1:

• Update latest to 1.27.11 (#5542)
• Remove old docs website action (#5465)
• Add a multus e2e test (#5483)
• Bump vsphere csi chart to 3.1.2-rancher101 and cpi to 1.7.001 (#5553)
• Fix DNS over TLS bug (#5552)
• Bump multus chart version (#5575)
• Update Calico and Canal to v3.27.2 (#5582)
• Bump K3s version for v1.29 (#5587)
• Fix: use correct wasm shims names
• Bump spegel to v0.0.18-k3s3
• Adds wildcard registry support
• Fixes issue with excessive CPU utilization while waiting for containerd to start
• Add env var to allow spegel mirroring of latest tag
• Bump helm-controller/klipper-helm versions
• Fix snapshot prune
• Fix issue with etcd node name missing hostname
• Fix additional corner cases in registries handling
• RKE2 will now warn and suppress duplicate entries in the mirror endpoint list for a registry. Containerd does not support listing the same endpoint multiple times as a mirror for a single upstream registry.
• Bump K3s version for v1.29 (#5605)
• Update k8s to 1.29.3 and Go (#5624)
• Actually bump k8s (#5627)

Charts Versions

| Component | Version |
| --- | --- |
| rke2-cilium | 1.15.100 |
| rke2-canal | v3.27.2-build2024030800 |
| rke2-calico | v3.27.200 |
| rke2-calico-crd | v3.27.002 |
| rke2-coredns | 1.29.002 |
| rke2-ingress-nginx | 4.8.200 |
| rke2-metrics-server | 2.11.100-build2023051513 |
| rancher-vsphere-csi | 3.1.2-rancher101 |
| rancher-vsphere-cpi | 1.7.001 |
| harvester-cloud-provider | 0.2.200 |
| harvester-csi-driver | 0.1.1700 |
| rke2-snapshot-controller | 1.7.202 |
| rke2-snapshot-controller-crd | 1.7.202 |
| rke2-snapshot-validation-webhook | 1.7.302 |

Packaged Component Versions

| Component | Version |
| --- | --- |
| Kubernetes | v1.29.3 |
| Etcd | v3.5.9-k3s1 |
| Containerd | v1.7.11-k3s2 |
| Runc | v1.1. |
| Metrics-server | v0.6.3 |
| CoreDNS | v1.11.1 |
| Ingress-Nginx | nginx-1.9.3-hardened1 |
| Helm-controller | v0.15.9 |

Available CNIs

| Component | Version | FIPS Compliant |
| --- | --- | --- |
| Canal (Default) | Flannel v0.24.3
Calico v3.27.2 | Yes |
| Calico | v3.27.2 | No |
| Cilium | v1.15.1 | No |
| Multus | v4.0.2 | No |
| Flannel | v0.24.4 | Yes |

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- Open issues here
- Join our Slack channel
- Check out our documentation for guidance on how to get started.