Linode Kubernetes Engine - Release Notes

Changed

• Upgraded clusters using Kubernetes 1.26 to patch version 1.26.9

Added

• Kubernetes 1.27 is now available on LKE. Review the Kubernetes changelog and blog post.

  Kubernetes 1.27 locks the LegacyServiceAccountTokenNoAutoGeneration feature gate that enables the token controller to automatically create API server access tokens for Kubernetes service accounts. After upgrading to 1.27, customers may notice a warning message regarding these legacy tokens:

  Warning: Use tokens from the TokenRequest API or manually created secret-based tokens instead of autogenerated secret-based tokens.
  

  To fix this issue, remove any auto-generated secrets of type kubernetes.io/service-account-token in the kube-system namespace with kubectl delete secrets -n kube-system --field-selector="type==kubernetes.io/service-account-token" and regenerate the cluster’s Kubeconfig. See the Kubernetes Cluster Regenerate ( (POST /lke/clusters/{clusterId}/regenerate) endpoint.

  Customers with service accounts outside of kube-system need to delete the auto-generated service account tokens in their respective namespaces.

Changed

• Updated references for k8s.gcr.io to registry.k8s.io.

Added

• Ability to force-rotate Service Account tokens without permanently breaking the control-plane.
  • In order to manually rotate Service Account tokens used by the control-plane, delete secrets with the type kubernetes.io/service-account-token in the kube-system namespace.
  • Deleting ccm-user-token-* secrets can still result in a momentary disruption of the control-plane.
  • Deleting lke-admin-token-* secrets invalidates the current kubeconfig. Allow some time for the new token to propagate to the control-plane before downloading a new kubeconfig via the API or Cloud Manager.

Changed

• Upgraded clusters using Kubernetes 1.25 to patch version 1.25.12
• Upgraded clusters using Kubernetes 1.26 to patch version 1.26.7

Fixed

• Improvements to etcd stability.

Changed

• Updated Calico version to v3.25
• Updated CSI version to v0.5.2

Added

• Kubernetes 1.26 is now available on LKE. Review the Kubernetes changelog and blog post.

Changed

• Upgraded clusters using Kubernetes 1.24 to patch version 1.24.12
• Upgraded clusters using Kubernetes 1.25 to patch version 1.25.8
• Upgraded the CCM to version v0.3.17

Added

• Kubeconfig files and Service Account tokens can be regenerated through the Linode API. See the Kubernetes Cluster Regenerate ( POST /lke/clusters/{clusterId}/regenerate) and Service Token Delete ( DELETE /lke/clusters/{clusterId}/servicetoken) endpoints.

Changed

• Upgraded clusters using Kubernetes 1.25 to patch version 1.25.6.
• Upgraded clusters using Kubernetes 1.24 to patch version 1.24.10.

Added

• Kubernetes 1.25 is now available on LKE. Review the Kubernetes changelog and blog post.

Changed

• Updated Calico from v3.22.1 to v3.24.5

Added

• Kubernetes 1.24 is now available on LKE. Review the Kubernetes changelog and blog post.

  Note

  The dockershim component was removed in upstream Kubernetes starting at version 1.24 (see Dockershim Removal FAQ). The Linode Kubernetes Engine has kept this component installed on 1.24 LKE nodes in case any customer is reliant on that feature. When deploying a new LKE cluster using Kubernetes v1.24 (and later versions), the default container runtime has been changed to containerd.

Changed

• Upgraded clusters using Kubernetes 1.23 to patch version 1.23.8.
• Upgraded clusters using Kubernetes 1.22 to patch version 1.22.11.
• Made stability improvements to Kubernetes dashboard
• Made stability improvements to etcd
• Removed support for Kubernetes v1.21
• Update linode-blockstorage-csi-driver to v0.5.0

Added

• Add a podAntiAffinity rule to the CoreDNS deployment, so that CoreDNS pods are scheduled to separate nodes.

Changed

• Upgrade Linode CCM from v0.3.15 to v0.3.16