Release v2.3.1
Important
-
Please review the v2.3.0 release notes for important updates/ breaking changes.
-
This release comes with the latest Kubernetes versions, i.e. v1.13.12, v1.14.8, v1.15.5, for Rancher launched Kubernetes clusters to address the CVE-2019-11253 and CVE-2019-16276. Rancher recommends upgrading all Kubernetes clusters to these Kubernetes versions.
-
If you launch a single node Rancher install with the LetsEncrypt option, you must upgrade to this Rancher version to be able to get and renew certificates from LetsEncrypt. LetsEncrypt is rolling out the deprecation of their v1 API endpoints and the deprecation will be permanent starting Nov 1.
-
Recent changes to cert-manager require an upgrade if you have an HA install of Rancher using self-signed certificates. If you are using cert-manager older than v0.9.1, please see the documentation on how to upgrade cert-manager.
The following versions are now latest and stable:
| Type | Rancher Version | Docker Tag | Helm Repo | Helm Chart Version |
|---|---|---|---|---|
| Latest | v2.3.1 | rancher/rancher:latest |
server-charts/latest | v2.3.1 |
| Stable | v2.2.9 | rancher/rancher:stable |
server-charts/stable | v2.2.9 |
Please review our version documentation for more details on versioning and tagging conventions.
Features and Enhancements
Experimental Features
We have introduced the ability to turn on and off experimental components inside Rancher. Please refer to our docs on how to turn on the features.
Major Bugs Fixed Since v2.3.0
- Fixed an issue where single node installs using LetsEncrypt certs would not work due to referencing the v1 API [#23365]
- Fixed an issue where the jailer script wouldn’t finish cause of a timeout and allowed the timeout to be configurable [#22379, #23160]
- Fixed an issue where RKE templates where the k8s versions were not being handled correctly during template creation and template display. [#23360, #23359, 23361]
- Fixed an issue where an RKE template couldn’t enable Windows support for certain k8s versions [#23395]
- Fixed an issue where trying to update your cluster to a new RKE template revision was not working #23383]
- Fixed an issue where using the bundled system charts with a single node container or a bind mount would not work after upgrading [#23427]
- Upgraded yaml library used by Rancher and RKE to v2.2.4 version containing CVE-2019-11253 fix
Other notes
Air Gap Installations and Upgrades
In v2.3.0, an air gap install no longer requires mirroring the systems chart git repo. Please follow the directions on how to install Rancher to use the packaged systems chart.
Known Major Issues
- Windows Limitations - There are a couple of known limitations with Windows due to upstream issues:
- Windows pods cannot access the Kubernetes API when using VXLAN (Overlay) backend for the flannel network provider. The workaround is to use the Host Gateway (L2bridge) backend for the flannel network provider. [#20968]
- Logging only works on Host Gateway (L2bridge) backend for the flannel network provider [#20510]
- Istio Limitation - Istio will not work with a restricted pod security policy [#22469]
- HPA Limitation - HPA UI doesn’t work on GKE clusters as GKE doesn’t support the
v2beta2.autoscalingAPI [#22292] - Hardening Guide Limitations - If you have used Rancher’s hardening guide, there are some known issues
- Adding taints to existing node templates from an upgraded setup will not be applied unless a reconcile is triggered on the cluster. When scaling up/down worker nodes, no reconcile is triggered, but scaling up/down either control plane/etcd nodes or editing a cluster (like upgrading to the latest Kubernetes version) would update to support taints on the nodes. [#22672]
- Cluster alerting and logging can get stuck in
Updatingstate after upgrading Rancher. Workaround steps are provided in the issue [21480] - If you have Rancher cluster with OpenStack cloud provider having LoadBalancer set, and the cluster was provisioned on version 2.2.3 or less, the upgrade to the Rancher version v2.2.4 and up will fail. Steps to mitigate can be found in the comment to [20699]
Versions
Images
- rancher/rancher:v2.3.1
- rancher/rancher-agent:v2.3.1
Tools
Kubernetes
Upgrades and Rollbacks
Rancher supports both upgrade and rollback. Please note the version you would like to upgrade or rollback to change the Rancher version.
Please be aware that upon an upgrade to v2.3.0+, any edits to a Rancher launched Kubernetes cluster will cause all system components to restart due to added tolerations to Kubernetes system components. Plan accordingly.
Recent changes to cert-manager require an upgrade if you have an HA install of Rancher using self-signed certificates. If you are using cert-manager older than v0.9.1, please see the documentation on how to upgrade cert-manager.
Important: When rolling back, we are expecting you to rollback to the state at the time of your upgrade. Any changes post upgrade would not be reflected.