Skip to content

Commit fbd134f

Browse files
authored
rke2: switch to minor release versions (#379844)
2 parents c4a805b + 36cb383 commit fbd134f

File tree

11 files changed

+211
-181
lines changed

11 files changed

+211
-181
lines changed
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
rke2Version = "1.29.13+rke2r1";
3+
rke2Commit = "00803ef95072be9d13b6e52a56fa9b6d9e7b0a51";
4+
rke2TarballHash = "sha256-1OphaTrEU2MvV0kdEyxomRGgbl/YSVikcYtLuL3QnBI=";
5+
rke2VendorHash = "sha256-6XczvyQMqYqHHu+cSsmXsi7zMG128ZwiAHr482qQqpI=";
6+
k8sImageTag = "v1.29.13-rke2r1-build20250117";
7+
etcdVersion = "v3.5.16-k3s1-build20241106";
8+
pauseVersion = "3.6";
9+
ccmVersion = "v1.29.10-0.20241016053521-9510ac25fefb-build20241016";
10+
dockerizedVersion = "v1.29.13-rke2r1";
11+
}
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
rke2Version = "1.30.9+rke2r1";
3+
rke2Commit = "bfd23524f32a4d9fa6f19ab58a2d47572e56f813";
4+
rke2TarballHash = "sha256-/WVKmK9ZackY9ULST0zFi/RRwA4ZR3u1DXULWTc6G3o=";
5+
rke2VendorHash = "sha256-kghiYswm3s7bILGp8t452jx84MY73EF9OTaWdncFr34=";
6+
k8sImageTag = "v1.30.9-rke2r1-build20250116";
7+
etcdVersion = "v3.5.16-k3s1-build20241106";
8+
pauseVersion = "3.6";
9+
ccmVersion = "v1.30.6-0.20241016053533-5ec454f50e7a-build20241016";
10+
dockerizedVersion = "v1.30.9-rke2r1";
11+
}

pkgs/applications/networking/cluster/rke2/stable/versions.nix renamed to pkgs/applications/networking/cluster/rke2/1_31/versions.nix

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,9 @@
33
rke2Commit = "08e198bbe3f0b8d4c9b0af4d92085c06bb94aa89";
44
rke2TarballHash = "sha256-GG1GOs/kLWDCvc/+l0ymRpJzEthIyGpampCjvfnEPB8=";
55
rke2VendorHash = "sha256-xWqMidOWiLgJXp6AEITkyOieLw4yi1JMmi80YS4RNy0=";
6-
k8sVersion = "v1.31.5";
76
k8sImageTag = "v1.31.5-rke2r1-build20250115";
87
etcdVersion = "v3.5.16-k3s1-build20241106";
98
pauseVersion = "3.6";
109
ccmVersion = "v1.31.2-0.20241016053446-0955fa330f90-build20241016";
1110
dockerizedVersion = "v1.31.5-rke2r1";
12-
golangVersion = "go1.22.10";
13-
eol = "2025-10-28";
1411
}

pkgs/applications/networking/cluster/rke2/latest/versions.nix renamed to pkgs/applications/networking/cluster/rke2/1_32/versions.nix

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,9 @@
33
rke2Commit = "c0f7be4407cf2c437cacfe735e5c943e827f2ff8";
44
rke2TarballHash = "sha256-clZpTnMnj2PRDDYz7+r11RlyX2ExwsE1Tmdt3/kUmtE=";
55
rke2VendorHash = "sha256-aIB2fRkccx5fXMnFxZ+tirXp5gg8o/h/a6Lgc+EG4L4=";
6-
k8sVersion = "v1.32.1";
76
k8sImageTag = "v1.32.1-rke2r1-build20250115";
87
etcdVersion = "v3.5.16-k3s1-build20241106";
98
pauseVersion = "3.6";
109
ccmVersion = "v1.32.0-rc3.0.20241220224140-68fbd1a6b543-build20250101";
1110
dockerizedVersion = "v1.32.1-rke2r1";
12-
golangVersion = "go1.23.4";
13-
eol = "2026-02-28";
1411
}
Lines changed: 30 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,42 @@
11
# RKE2 Version
22

3-
RKE2, Kubernetes, and other clustered software has the property of not being able to update atomically.
4-
Most software in nixpkgs, like for example bash, can be updated as part of a `nixos-rebuild switch`
5-
without having to worry about the old and the new bash interacting in some way.
3+
RKE2, Kubernetes, and other clustered software has the property of not being able to update
4+
atomically. Most software in nixpkgs, like for example bash, can be updated as part of a
5+
`nixos-rebuild switch` without having to worry about the old and the new bash interacting in some
6+
way. RKE2/Kubernetes, on the other hand, is typically run across several machines, and each machine
7+
is updated independently. As such, different versions of the package and NixOS module must maintain
8+
compatibility with each other through temporary version skew during updates. The upstream Kubernetes
9+
project documents this in their
10+
[version-skew policy](https://kubernetes.io/releases/version-skew-policy/#supported-component-upgrade-order).
11+
12+
Within nixpkgs, we strive to maintain a valid "upgrade path" that does not run afoul of the upstream
13+
version skew policy.
614

715
> [!NOTE]
8-
> Upgrade the server nodes first, one at a time. Once all servers have been upgraded, you may then upgrade agent nodes.
16+
> Upgrade the server nodes first, one at a time. Once all servers have been upgraded, you may then
17+
> upgrade agent nodes.
918
1019
## Release Channels
1120

12-
RKE2 has three main release channels, which are: `stable`, `latest` and `testing`.
21+
RKE2 has two named release channels, i.e. `stable` and `latest`. Additionally, there exists a
22+
release channel tied to each Kubernetes minor version, e.g. `v1.32`.
1323

14-
The `stable` channel is the default channel and is recommended for production use.
15-
The `latest` channel is the latest release.
16-
The `testing` channel is the latest release, including pre-releases.
24+
Nixpkgs follows active minor version release channels (typically 4 at a time) and sets aliases for
25+
`rke2_stable` and `rke2_latest` accordingly.
1726

18-
| Channel | Description |
19-
| --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
20-
| `stable` | **(Default)** Stable is recommended for production environments. These releases have been through a period of community hardening, and are compatible with the most recent release of Rancher. |
21-
| `latest` | Latest is recommended for trying out the latest features. These releases have not yet been through a period of community hardening, and may not be compatible with Rancher. |
22-
| `testing` | The most recent release, including pre-releases. |
27+
Patch releases should be backported to to the latest stable release branch, however, new minor
28+
versions are not backported.
2329

24-
Learn more about the [RKE2 release channels](https://docs.rke2.io/upgrade/manual_upgrade).
30+
For further information visit the
31+
[RKE2 release channels documentation](https://docs.rke2.io/upgrades/manual_upgrade?_highlight=manua#release-channels).
2532

26-
For an exhaustive and up-to-date list of channels, you can visit the
27-
[rke2 channel service API](https://update.rke2.io/v1-release/channels).
28-
For more technical details on how channels work, you can see the [channelserver project](https://github.com/rancher/channelserver).
33+
## EOL Versions
2934

30-
> [!TIP]
31-
> When attempting to upgrade to a new version of RKE2,
32-
> the [Kubernetes version skew policy](https://kubernetes.io/docs/setup/release/version-skew-policy) applies.
33-
> Ensure that your plan **does not skip intermediate minor versions** when upgrading. Nothing in the upgrade process will
34-
> protect you against unsupported changes to the Kubernetes version.
35+
Approximately every 4 months a minor RKE2 version reaches EOL. EOL versions should be removed from
36+
`nixpkgs-unstable`, preferably by throwing with an explanatory message in
37+
`pkgs/top-level/aliases.nix`. With stable releases, however, it isn't expected that packages will be
38+
removed. Instead we set `meta.knownVulnerabilities` for stable EOL packages, like it is also done
39+
for EOL JDKs, browser engines, Node.js versions, etc.
40+
41+
For further information on the RKE2 lifecycle, see the
42+
[SUSE Product Support Lifecycle page](https://www.suse.com/lifecycle#rke2).

pkgs/applications/networking/cluster/rke2/builder.nix

Lines changed: 98 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ lib:
1010
pauseVersion,
1111
ccmVersion,
1212
dockerizedVersion,
13-
...
1413
}:
1514

1615
# Build dependencies
@@ -42,107 +41,108 @@ lib:
4241
# Testing dependencies
4342
nixosTests,
4443
testers,
45-
rke2,
4644
}:
45+
let
46+
rke2 = buildGoModule rec {
47+
pname = "rke2";
48+
version = rke2Version;
49+
50+
src = fetchzip {
51+
url = "https://github.com/rancher/rke2/archive/refs/tags/v${rke2Version}.tar.gz";
52+
hash = "${rke2TarballHash}";
53+
};
4754

48-
buildGoModule rec {
49-
pname = "rke2";
50-
version = rke2Version;
55+
vendorHash = rke2VendorHash;
56+
57+
nativeBuildInputs = [ makeWrapper ];
58+
59+
# Important utilities used by the kubelet.
60+
# See: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
61+
# Notice the list in that issue is stale, but as a redundancy reservation.
62+
buildInputs = [
63+
procps # pidof pkill
64+
coreutils # uname touch env nice du
65+
util-linux # lsblk fsck mkfs nsenter mount umount
66+
ethtool # ethtool
67+
socat # socat
68+
iptables # iptables iptables-restore iptables-save
69+
bridge-utils # brctl
70+
iproute2 # ip tc
71+
kmod # modprobe
72+
lvm2 # dmsetup
73+
];
5174

52-
src = fetchzip {
53-
url = "https://github.com/rancher/rke2/archive/refs/tags/v${rke2Version}.tar.gz";
54-
hash = "${rke2TarballHash}";
55-
};
75+
# See: https://github.com/rancher/rke2/blob/e7f87c6dd56fdd76a7dab58900aeea8946b2c008/scripts/build-binary#L27-L38
76+
ldflags = [
77+
"-w"
78+
"-X github.com/k3s-io/k3s/pkg/version.GitCommit=${lib.substring 0 6 rke2Commit}"
79+
"-X github.com/k3s-io/k3s/pkg/version.Program=${pname}"
80+
"-X github.com/k3s-io/k3s/pkg/version.Version=v${version}"
81+
"-X github.com/k3s-io/k3s/pkg/version.UpstreamGolang=go${go.version}"
82+
"-X github.com/rancher/rke2/pkg/images.DefaultRegistry=docker.io"
83+
"-X github.com/rancher/rke2/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${etcdVersion}"
84+
"-X github.com/rancher/rke2/pkg/images.DefaultKubernetesImage=rancher/hardened-kubernetes:${k8sImageTag}"
85+
"-X github.com/rancher/rke2/pkg/images.DefaultPauseImage=rancher/mirrored-pause:${pauseVersion}"
86+
"-X github.com/rancher/rke2/pkg/images.DefaultRuntimeImage=rancher/rke2-runtime:${dockerizedVersion}"
87+
"-X github.com/rancher/rke2/pkg/images.DefaultCloudControllerManagerImage=rancher/rke2-cloud-provider:${ccmVersion}"
88+
];
5689

57-
vendorHash = rke2VendorHash;
58-
59-
nativeBuildInputs = [ makeWrapper ];
60-
61-
# Important utilities used by the kubelet.
62-
# See: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
63-
# Notice the list in that issue is stale, but as a redundancy reservation.
64-
buildInputs = [
65-
procps # pidof pkill
66-
coreutils # uname touch env nice du
67-
util-linux # lsblk fsck mkfs nsenter mount umount
68-
ethtool # ethtool
69-
socat # socat
70-
iptables # iptables iptables-restore iptables-save
71-
bridge-utils # brctl
72-
iproute2 # ip tc
73-
kmod # modprobe
74-
lvm2 # dmsetup
75-
];
76-
77-
# See: https://github.com/rancher/rke2/blob/e7f87c6dd56fdd76a7dab58900aeea8946b2c008/scripts/build-binary#L27-L38
78-
ldflags = [
79-
"-w"
80-
"-X github.com/k3s-io/k3s/pkg/version.GitCommit=${lib.substring 0 6 rke2Commit}"
81-
"-X github.com/k3s-io/k3s/pkg/version.Program=${pname}"
82-
"-X github.com/k3s-io/k3s/pkg/version.Version=v${version}"
83-
"-X github.com/k3s-io/k3s/pkg/version.UpstreamGolang=go${go.version}"
84-
"-X github.com/rancher/rke2/pkg/images.DefaultRegistry=docker.io"
85-
"-X github.com/rancher/rke2/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${etcdVersion}"
86-
"-X github.com/rancher/rke2/pkg/images.DefaultKubernetesImage=rancher/hardened-kubernetes:${k8sImageTag}"
87-
"-X github.com/rancher/rke2/pkg/images.DefaultPauseImage=rancher/mirrored-pause:${pauseVersion}"
88-
"-X github.com/rancher/rke2/pkg/images.DefaultRuntimeImage=rancher/rke2-runtime:${dockerizedVersion}"
89-
"-X github.com/rancher/rke2/pkg/images.DefaultCloudControllerManagerImage=rancher/rke2-cloud-provider:${ccmVersion}"
90-
];
91-
92-
tags = [
93-
"no_cri_dockerd"
94-
"no_embedded_executor"
95-
"no_stage"
96-
"sqlite_omit_load_extension"
97-
"selinux"
98-
"netgo"
99-
"osusergo"
100-
];
101-
102-
subPackages = [ "." ];
103-
104-
installPhase = ''
105-
install -D $GOPATH/bin/rke2 $out/bin/rke2
106-
wrapProgram $out/bin/rke2 \
107-
--prefix PATH : ${lib.makeBinPath buildInputs}
108-
109-
install -D ./bundle/bin/rke2-killall.sh $out/bin/rke2-killall.sh
110-
wrapProgram $out/bin/rke2-killall.sh \
111-
--prefix PATH : ${
112-
lib.makeBinPath [
113-
systemd
114-
gnugrep
115-
gnused
116-
]
117-
} \
118-
--prefix PATH : ${lib.makeBinPath buildInputs}
119-
'';
120-
121-
doCheck = false;
122-
123-
passthru.updateScript = updateScript;
124-
125-
passthru.tests =
126-
{
127-
version = testers.testVersion {
128-
package = rke2;
129-
version = "v${version}";
90+
tags = [
91+
"no_cri_dockerd"
92+
"no_embedded_executor"
93+
"no_stage"
94+
"sqlite_omit_load_extension"
95+
"selinux"
96+
"netgo"
97+
"osusergo"
98+
];
99+
100+
subPackages = [ "." ];
101+
102+
installPhase = ''
103+
install -D $GOPATH/bin/rke2 $out/bin/rke2
104+
wrapProgram $out/bin/rke2 \
105+
--prefix PATH : ${lib.makeBinPath buildInputs}
106+
107+
install -D ./bundle/bin/rke2-killall.sh $out/bin/rke2-killall.sh
108+
wrapProgram $out/bin/rke2-killall.sh \
109+
--prefix PATH : ${
110+
lib.makeBinPath [
111+
systemd
112+
gnugrep
113+
gnused
114+
]
115+
} \
116+
--prefix PATH : ${lib.makeBinPath buildInputs}
117+
'';
118+
119+
doCheck = false;
120+
121+
passthru.updateScript = updateScript;
122+
123+
passthru.tests =
124+
{
125+
version = testers.testVersion {
126+
package = rke2;
127+
version = "v${version}";
128+
};
129+
}
130+
// lib.optionalAttrs stdenv.hostPlatform.isLinux {
131+
inherit (nixosTests) rke2;
130132
};
131-
}
132-
// lib.optionalAttrs stdenv.hostPlatform.isLinux {
133-
inherit (nixosTests) rke2;
134-
};
135133

136-
meta = with lib; {
137-
homepage = "https://github.com/rancher/rke2";
138-
description = "RKE2, also known as RKE Government, is Rancher's next-generation Kubernetes distribution";
139-
changelog = "https://github.com/rancher/rke2/releases/tag/v${version}";
140-
license = licenses.asl20;
141-
maintainers = with maintainers; [
142-
zimbatm
143-
zygot
144-
];
145-
mainProgram = "rke2";
146-
platforms = platforms.linux;
134+
meta = with lib; {
135+
homepage = "https://github.com/rancher/rke2";
136+
description = "RKE2, also known as RKE Government, is Rancher's next-generation Kubernetes distribution";
137+
changelog = "https://github.com/rancher/rke2/releases/tag/v${version}";
138+
license = licenses.asl20;
139+
maintainers = with maintainers; [
140+
zimbatm
141+
zygot
142+
];
143+
mainProgram = "rke2";
144+
platforms = platforms.linux;
145+
};
147146
};
148-
}
147+
in
148+
rke2

pkgs/applications/networking/cluster/rke2/default.nix

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,34 +4,48 @@ let
44
common = opts: callPackage (import ./builder.nix lib opts);
55
extraArgs = builtins.removeAttrs args [ "callPackage" ];
66
in
7-
{
8-
rke2_stable = common (
9-
(import ./stable/versions.nix)
7+
rec {
8+
rke2_1_29 = common (
9+
(import ./1_29/versions.nix)
1010
// {
1111
updateScript = [
1212
./update-script.sh
13-
"stable"
13+
"29"
1414
];
1515
}
1616
) extraArgs;
1717

18-
rke2_latest = common (
19-
(import ./latest/versions.nix)
18+
rke2_1_30 = common (
19+
(import ./1_30/versions.nix)
2020
// {
2121
updateScript = [
2222
./update-script.sh
23-
"latest"
23+
"30"
2424
];
2525
}
2626
) extraArgs;
2727

28-
rke2_testing = common (
29-
(import ./testing/versions.nix)
28+
rke2_1_31 = common (
29+
(import ./1_31/versions.nix)
3030
// {
3131
updateScript = [
3232
./update-script.sh
33-
"testing"
33+
"31"
3434
];
3535
}
3636
) extraArgs;
37+
38+
rke2_1_32 = common (
39+
(import ./1_32/versions.nix)
40+
// {
41+
updateScript = [
42+
./update-script.sh
43+
"32"
44+
];
45+
}
46+
) extraArgs;
47+
48+
# Automatically set by update script
49+
rke2_stable = rke2_1_31;
50+
rke2_latest = rke2_1_32;
3751
}

0 commit comments

Comments
 (0)