feat(github-release): update k3s-io/k3s to v1.28.3+k3s1

[renovate]

This PR contains the following updates:

Package	Update	Change
k3s-io/k3s	minor	v1.27.2+k3s1 -> v1.28.3+k3s1

---

Release Notes

k3s-io/k3s (k3s-io/k3s)

v1.28.3+k3s1: v1.28.3+k3s1

Compare Source

This release updates Kubernetes to v1.28.3, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.28.2+k3s1:

• Fix error reporting (#​8250)
• Add context to flannel errors (#​8284)
• Update channel, September patch release (#​8397)
• Add missing link to drone in documentation (#​8295)
• Include the interface name in the error message (#​8346)
• Add extraArgs to vpn provider (#​8354)
  • Allow to pass extra args to the vpn provider
• Disable HTTP on main etcd client port (#​8402)
  • Embedded etcd no longer serves http requests on the client port, only grpc. This addresses a performance issue that could cause watch stream starvation under load. For more information, see https://github.com/etcd-io/etcd/issues/15402
• Server token rotation (#​8215)
• Fix issues with etcd member removal after reset (#​8392)
  • Fixed an issue that could cause k3s to attempt to remove members from the etcd cluster immediately following a cluster-reset/restore, if they were queued for removal at the time the snapshot was taken.
• Fix gofmt error (#​8439)
• Added advertise address integration test (#​8344)
• Added cluster reset from non bootstrap nodes on snapshot restore e2e test (#​8292)
• Fix .github regex to skip drone runs on gh action bumps (#​8433)
• Added error when cluster reset while using server flag (#​8385)
  • The user will receive a error when --cluster-reset with the --server flag
• Update kube-router (#​8423)
  • Update kube-router to v2.0.0-rc7 to fix performance issues
• Add SHA256 signatures of the install script (#​8312)
  • • Add SHA256 signatures of the install script.
• Add --image-service-endpoint flag (#​8279)
  • Add --image-service-endpoint flag to specify an external image service socket.
• Don't ignore assets in home dir if system assets exist (#​8458)
• Pass SystemdCgroup setting through to nvidia runtime options (#​8470)
  • Fixed issue that would cause pods using nvidia container runtime to be killed after a few seconds, when using newer versions of nvidia-container-toolkit.
• Improve release docs - updated (#​8414)
• Take IPFamily precedence based on order (#​8460)
• Fix spellcheck problem (boostrap ==> bootstrap) (#​8507)
• Network defaults are duplicated, remove one (#​8523)
• Fix slemicro check for selinux (#​8526)
• Update install.sh.sha256sum (#​8566)
• System agent push tags fix (#​8568)
• Fixed tailscale node IP dualstack mode in case of IPv4 only node (#​8524)
• Server Token Rotation (#​8265)
  • Users can now rotate the server token using k3s token rotate -t <OLD_TOKEN> --new-token <NEW_TOKEN>. After command succeeds, all server nodes must be restarted with the new token.
• E2E Domain Drone Cleanup (#​8579)
• Bump containerd to v1.7.7-k3s1 (#​8604)
• Bump busybox to v1.36.1 (#​8602)
• Migrate to using custom resource to store etcd snapshot metadata (#​8064)
• Switch build target from main.go to a package. (#​8342)
• Use IPv6 in case is the first configured IP with dualstack (#​8581)
• Bump traefik, golang.org/x/net, google.golang.org/grpc (#​8624)
• Update kube-router package in build script (#​8630)
• Add etcd-only/control-plane-only server test and fix control-plane-only server crash (#​8638)
• Use version.Program not K3s in token rotate logs (#​8653)
• [Windows Port (#​7259)
• Fix CloudDualStackNodeIPs feature-gate inconsistency (#​8667)
• Re-enable etcd endpoint auto-sync (#​8675)
• Manually requeue configmap reconcile when no nodes have reconciled snapshots (#​8683)
• Update to v1.28.3 and Go to v1.20.10 (#​8682)
• Fix s3 snapshot restore (#​8729)

Embedded Component Versions

Component	Version
Kubernetes	v1.28.3
Kine	v0.10.3
SQLite	3.42.0
Etcd	v3.5.9-k3s1
Containerd	v1.7.7-k3s1
Runc	v1.1.8
Flannel	v0.22.2
Metrics-server	v0.6.3
Traefik	v2.10.5
CoreDNS	v1.10.1
Helm-controller	v0.15.4
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.28.3+k3s2: v1.28.3+k3s2

Compare Source

v1.28.2+k3s1: v1.28.2+k3s1

Compare Source

This release updates Kubernetes to v1.28.2, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.28.1+k3s1:

• Update channel for version v1.28 (#​8305)
• Bump kine to v0.10.3 (#​8323)
• Update to v1.28.2 and go v1.20.8 (#​8364)
  • Bump embedded containerd to v1.7.6
  • Bump embedded stargz-snapshotter plugin to latest
  • Fixed intermittent drone CI failures due to race conditions in test environment setup scripts
  • Fixed CI failures due to changes to api discovery changes in Kubernetes 1.28

Embedded Component Versions

Component	Version
Kubernetes	v1.28.2
Kine	v0.10.3
SQLite	3.42.0
Etcd	v3.5.9-k3s1
Containerd	v1.7.6-k3s1
Runc	v1.1.8
Flannel	v0.22.2
Metrics-server	v0.6.3
Traefik	v2.9.10
CoreDNS	v1.10.1
Helm-controller	v0.15.4
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.28.1+k3s1: v1.28.1+k3s1

Compare Source

This release is K3S's first in the v1.28 line. This release updates Kubernetes to v1.28.1.

⚠️ IMPORTANT: This release includes remediation for CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See GHSA-m4hf-6vgr-75r2 for more information, including documentation on changes in behavior that harden clusters against this vulnerability.

Kubernetes v1.28 contains a critical regression (kubernetes/kubernetes#120247) that causes init containers to run at the same time as app containers following a restart of the node. This issue will be fixed in v1.28.2. We do not recommend using K3s v1.28 at this time if your application depends on init containers.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.27.5+k3s1:

• Update to v1.28.1 (#​8239)
• CLI Removal for v1.28.0 (#​8203)
• Secrets Encryption V3 (#​8111)
• Add new CLI flag to disable TLS SAN CN filtering (#​8252)
  • Added a new --tls-san-security option.
• Add RWMutex to address controller (#​8268)

Embedded Component Versions

Component	Version
Kubernetes	v1.28.1
Kine	v0.10.3
SQLite	3.42.0
Etcd	v3.5.9-k3s1
Containerd	v1.7.3-k3s2
Runc	v1.1.8
Flannel	v0.22.2
Metrics-server	v0.6.3
Traefik	v2.9.10
CoreDNS	v1.10.1
Helm-controller	v0.15.4
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.27.7+k3s1: v1.27.7+k3s1

Compare Source

This release updates Kubernetes to v1.27.7, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.27.6+k3s1:

• Fix error reporting (#​8411)
• Add context to flannel errors (#​8419)
• Include the interface name in the error message (#​8435)
• Update kube-router (#​8443)
• Add extraArgs to tailscale (#​8464)
• Added error when cluster reset while using server flag (#​8455)
  • The user will receive a error when --cluster-reset with the --server flag
• Cluster reset from non boostrap nodes (#​8451)
• Take IPFamily precedence based on order (#​8504)
• Fix spellcheck problem (boostrap ==> bootstrap) (#​8509)
• Network defaults are duplicated, remove one (#​8551)
• Advertise address integration test (#​8516)
• System agent push tags fix (#​8569)
• Fixed tailscale node IP dualstack mode in case of IPv4 only node (#​8558)
• Server Token Rotation (#​8576)
  • Users can now rotate the server token using k3s token rotate -t <OLD_TOKEN> --new-token <NEW_TOKEN>. After command succeeds, all server nodes must be restarted with the new token.
• E2E Domain Drone Cleanup (#​8582)
• Clear remove annotations on cluster reset (#​8587)
  • Fixed an issue that could cause k3s to attempt to remove members from the etcd cluster immediately following a cluster-reset/restore, if they were queued for removal at the time the snapshot was taken.
• Use IPv6 in case is the first configured IP with dualstack (#​8597)
• Backports for 2023-10 release (#​8615)
• Update kube-router package in build script (#​8634)
• Add etcd-only/control-plane-only server test and fix control-plane-only server crash (#​8642)
• Use version.Program not K3s in token rotate logs (#​8656)
• Windows agent support (#​8650)
• Fix CloudDualStackNodeIPs feature-gate inconsistency (#​8669)
• Add --image-service-endpoint flag (#​8279) (#​8662)
  • Add --image-service-endpoint flag to specify an external image service socket.
• Backport etcd fixes (#​8690)
  • Re-enable etcd endpoint auto-sync
  • Manually requeue configmap reconcile when no nodes have reconciled snapshots
• Update to v1.27.7 and Go to v1.20.10 (#​8681)
• Fix s3 snapshot restore (#​8733)

Embedded Component Versions

Component	Version
Kubernetes	v1.27.7
Kine	v0.10.3
SQLite	3.42.0
Etcd	v3.5.9-k3s1
Containerd	v1.7.7-k3s1.27
Runc	v1.1.8
Flannel	v0.22.2
Metrics-server	v0.6.3
Traefik	v2.10.5
CoreDNS	v1.10.1
Helm-controller	v0.15.4
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.27.7+k3s2: v1.27.7+k3s2

Compare Source

v1.27.6+k3s1: v1.27.6+k3s1

Compare Source

This release updates Kubernetes to v1.27.6, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.27.5+k3s1:

• Bump kine to v0.10.3 (#​8324)
• Update to v1.27.6 and Go to 1.20.8 (#​8356)
  • Bump embedded containerd to v1.7.6
  • Bump embedded stargz-snapshotter plugin to latest
  • Fixed intermittent drone CI failures due to race conditions in test environment setup scripts
  • Fixed CI failures due to changes to api discovery changes in Kubernetes 1.28

Embedded Component Versions

Component	Version
Kubernetes	v1.27.6
Kine	v0.10.3
SQLite	3.42.0
Etcd	v3.5.9-k3s1
Containerd	v1.7.6-k3s1.27
Runc	v1.1.8
Flannel	v0.22.2
Metrics-server	v0.6.3
Traefik	v2.9.10
CoreDNS	v1.10.1
Helm-controller	v0.15.4
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.27.5+k3s1: v1.27.5+k3s1

Compare Source

This release updates Kubernetes to v1.27.5, and fixes a number of issues.

⚠️ IMPORTANT: This release includes support for remediating CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See GHSA-m4hf-6vgr-75r2 for more information, including mandatory steps necessary to harden clusters against this vulnerability.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.27.4+k3s1:

• Update cni plugins version to v1.3.0 (#​8056)
  • Upgraded cni-plugins to v1.3.0
• Update flannel to v0.22.1 (#​8057)
  • Update flannel to v0.22.1
• ADR on secrets encryption v3 (#​7938)
• Unit test for MustFindString (#​8013)
• Add support for using base template in etc/containerd/config.toml.tmpl (#​7991)
  • User-provided containerd config templates may now use {{ template "base" . }} to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file.
• Make apiserver egress args conditional on egress-selector-mode (#​7972)
  • K3s no longer enables the apiserver's enable-aggregator-routing flag when the egress proxy is not being used to route connections to in-cluster endpoints.
• Security bump to docker/distribution (#​8047)
• Fix coreos multiple installs (#​8083)
• Update stable channel to v1.27.4+k3s1 (#​8067)
• Fix tailscale bug with ip modes (#​8077)
• Consolidate CopyFile functions (#​8079)
• E2E: Support GOCOVER for more tests + fixes (#​8080)
• Fix typo in terraform/README.md (#​8090)
• Add FilterCN function to prevent SAN Stuffing (#​8085)
  • K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries.
• Bump docker/docker to master commit; cri-dockerd to 0.3.4 (#​8092)
  • Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client.
• Bump versions for etcd, containerd, runc (#​8109)
  • Updated the embedded containerd to v1.7.3+k3s1
  • Updated the embedded runc to v1.1.8
  • Updated the embedded etcd to v3.5.9+k3s1
• Etcd snapshots retention when node name changes (#​8099)
• Bump kine to v0.10.2 (#​8125)
  • Updated kine to v0.10.2
• Remove terraform package (#​8136)
• Fix etcd-snapshot delete when etcd-s3 is true (#​8110)
• Add --disable-cloud-controller and --disable-kube-proxy test (#​8018)
• Use go list -m instead of grep to look up versions (#​8138)
• Use VERSION_K8S in tests instead of grep go.mod (#​8147)
• Fix for Kubeflag Integration test (#​8154)
• Fix for cluster-reset backup from s3 when etcd snapshots are disabled (#​8155)
• Run integration test CI in parallel (#​8156)
• Bump Trivy version (#​8150)
• Bump Trivy version (#​8178)
• Fixed the etcd retention to delete orphaned snapshots based on the date (#​8177)
• Bump dynamiclistener (#​8193)
  • Bumped dynamiclistener to address an issue that could cause the apiserver/supervisor listener on 6443 to stop serving requests on etcd-only nodes.
  • The K3s external apiserver/supervisor listener on 6443 now sends a complete certificate chain in the TLS handshake.
• Bump helm-controller/klipper-helm versions (#​8204)
  • The version of helm used by the bundled helm controller's job image has been updated to v3.12.3
• E2E: Add test for k3s token (#​8184)
• Move flannel to 0.22.2 (#​8219)
  • Move flannel to v0.22.2
• Update to v1.27.5 (#​8236)
• Add new CLI flag to enable TLS SAN CN filtering (#​8257)
  • Added a new --tls-san-security option. This flag defaults to false, but can be set to true to disable automatically adding SANs to the server's TLS certificate to satisfy any hostname requested by a client.
• Add RWMutex to address controller (#​8273)

Embedded Component Versions

Component	Version
Kubernetes	v1.27.5
Kine	v0.10.2
SQLite	3.42.0
Etcd	v3.5.9-k3s1
Containerd	v1.7.3-k3s1
Runc	v1.1.8
Flannel	v0.22.2
Metrics-server	v0.6.3
Traefik	v2.9.10
CoreDNS	v1.10.1
Helm-controller	v0.15.4
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.27.4+k3s1: v1.27.4+k3s1

Compare Source

This release updates Kubernetes to v1.27.4, and fixes a number of issues.
​
For more details on what's new, see the Kubernetes release notes.
​

Changes since v1.27.3+k3s1:

​

• Pkg imported more than once (#​7803)
• Faster K3s Binary Build Option (#​7805)
• Update stable channel to v1.27.3+k3s1 (#​7827)
• Adding cli to custom klipper helm image (#​7682)
  • The default helm-controller job image can now be overridden with the --helm-job-image CLI flag
• Check if we are on ipv4, ipv6 or dualStack when doing tailscale (#​7838)
• Remove file_windows.go (#​7845)
• Add a k3s data directory location specified by the cli (#​7791)
• Fix e2e startup flaky test (#​7839)
• Allow k3s to customize apiServerPort on helm-controller (#​7834)
• Fall back to basic/bearer auth when node identity auth is rejected (#​7836)
  • Resolved an issue that caused agents joined with kubeadm-style bootstrap tokens to fail to rejoin the cluster when their node object is deleted.
• Fix code spell check (#​7858)
• Add e2e s3 test (#​7833)
• Warn that v1.28 will deprecate reencrypt/prepare (#​7848)
• Support setting control server URL for Tailscale (#​7807)
  • Support connecting tailscale to a separate server (e.g. headscale)
• Improve for K3s release Docs (#​7864)
• Fix rootless node password location (#​7887)
• Bump google.golang.org/grpc from 1.51.0 to 1.53.0 in /tests/terraform (#​7879)
• Add retry for clone step (#​7862)
• Generation of certificates and keys for etcd gated if etcd is disabled. (#​6998)
• Don't use zgrep in check-config if apparmor porfile is enforced (#​7939)
• Fix image_scan.sh script and download trivy version (#​7950)
• Revert "Warn that v1.28 will deprecate reencrypt/prepare" (#​7977)
• Adjust default kubeconfig file permissions (#​7978)
• Fix update go version command on release documentation (#​8028)
• Update to v1.27.4 (#​8014)
  ​

Embedded Component Versions

Component	Version
Kubernetes	v1.27.4
Kine	v0.10.1
SQLite	3.39.2
Etcd	v3.5.7-k3s1
Containerd	v1.7.1-k3s1
Runc	v1.1.7
Flannel	v0.22.0
Metrics-server	v0.6.3
Traefik	v2.9.10
CoreDNS	v1.10.1
Helm-controller	v0.15.2
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.27.3+k3s1: v1.27.3+k3s1

Compare Source

This release updates Kubernetes to v1.27.3, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.27.2+k3s1:

• Update flannel version (#​7628)
  • Update flannel to v0.22.0
• Add el9 selinux rpm (#​7635)
• Update channels (#​7634)
• Allow coredns override extensions (#​7583)
  • The coredns-custom ConfigMap now allows for *.override sections to be included in the .:53 default server block.
• Bump klipper-lb to v0.4.4 (#​7617)
  • Bumped klipper-lb image to v0.4.4 to resolve an issue that prevented access to ServiceLB ports from localhost when the Service ExternalTrafficPolicy was set to Local.
• Bump metrics-server to v0.6.3 and update tls-cipher-suites (#​7564)
  • The bundled metrics-server has been bumped to v0.6.3, and now uses only secure TLS ciphers by default.
• Do not use the admin kubeconfig for the supervisor and core controllers (#​7616)
  • The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user.
• Bump golang:alpine image version (#​7619)
• Make LB image configurable when compiling k3s (#​7626)
• Bump vagrant libvirt with fix for plugin installs (#​7605)
• Add format command on Makefile (#​7437)
• Use el8 rpm for fedora 38 and 39 (#​7664)
• Check variant before version to decide rpm target and packager closes #​7666 (#​7667)
• Test Coverage Reports for E2E tests (#​7526)
• Soft-fail on node password verification if the secret cannot be created (#​7655)
  • K3s now allows nodes to join the cluster even if the node password secret cannot be created at the time the node joins. The secret create will be retried in the background. This resolves a potential deadlock created by fail-closed validating webhooks that block secret creation, where the webhook is unavailable until new nodes join the cluster to run the webhook pod.
• Enable containerd aufs/devmapper/zfs snapshotter plugins (#​7661)
  • The bundled containerd's aufs/devmapper/zfs snapshotter plugins have been restored. These were unintentionally omitted when moving containerd back into the k3s multicall binary in the previous release.
• Bump docker go.mod (#​7681)
• Shortcircuit commands with version or help flags (#​7683)
  • Non root users can now call k3s --help and k3s --version commands without running into permission errors over the default config file.
• Bump Trivy version (#​7672)
• E2E: Capture coverage of K3s subcommands (#​7686)
• Integrate tailscale into k3s (#​7352)
  • Integration of tailscale VPN into k3s
• Add private registry e2e test (#​7653)
• E2E: Remove unnecessary daemonset addition/deletion (#​7696)
• Add issue template for OS validation (#​7695)
• Fix spelling check (#​7740)
• Remove useless libvirt config (#​7745)
• Bump helm-controller to v0.15.0 for create-namespace support (#​7716)
  • The embedded helm controller has been bumped to v0.15.0, and now supports creating the chart's target namespace if it does not exist.
• Fix error logging in tailscale (#​7776)
• Add commands to remove advertised routes of tailscale in k3s-killall.sh (#​7777)
• Update Kubernetes to v1.27.3 (#​7790)

Embedded Component Versions

Component	Version
Kubernetes	v1.27.3
Kine	v0.10.1
SQLite	3.39.2
Etcd	v3.5.7-k3s1
Containerd	v1.7.1-k3s1
Runc	v1.1.7
Flannel	v0.22.0
Metrics-server	v0.6.3
Traefik	v2.9.10
CoreDNS	v1.10.1
Helm-controller	v0.15.0
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

---

Configuration

📅 Schedule: Branch creation - "on saturday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.