36 Release Notes #
36.1 Abstract #
SUSE Edge 3.1 is a tightly integrated and comprehensively validated end-to-end solution for addressing the unique challenges of the deployment of infrastructure and cloud-native applications at the edge. Its driving focus is to provide an opinionated, yet highly flexible, highly scalable, and secure platform that spans initial deployment image building, node provisioning and onboarding, application deployment, observability, and lifecycle management.
The solution is designed with the notion that there is no "one-size-fits-all" edge platform due to our customers’ widely varying requirements and expectations. Edge deployments push us to solve, and continually evolve, some of the most challenging problems, including massive scalability, restricted network availability, physical space constraints, new security threats and attack vectors, variations in hardware architecture and system resources, the requirement to deploy and interface with legacy infrastructure and applications, and customer solutions that have extended lifespans.
SUSE Edge is built on best-of-breed open source software from the ground up, consistent with both our 30-year history in delivering secure, stable, and certified SUSE Linux platforms and our experience in providing highly scalable and feature-rich Kubernetes management with our Rancher portfolio. SUSE Edge builds on-top of these capabilities to deliver functionality that can address a wide number of market segments, including retail, medical, transportation, logistics, telecommunications, smart manufacturing, and Industrial IoT.
SUSE Adaptive Telco Infrastructure Platform (ATIP) is a derivative (or downstream product) of SUSE Edge, with additional optimizations and components that enable the platform to address the requirements found in telecommunications use-cases. Unless explicitly stated, all the release notes are applicable for both SUSE Edge 3.1, and SUSE ATIP 3.1.
36.2 About #
These Release Notes are, unless explicitly specified and explained, identical across all architectures, and the most recent version, along with the release notes of all other SUSE products are always available online at https://www.suse.com/releasenotes.
Entries are only listed once, but they can be referenced in several places if they are important and belong to more than one section. Release notes usually only list changes that happened between two subsequent releases. Certain important entries from the release notes of previous product versions may be repeated. To make these entries easier to identify, they contain a note to that effect.
However, repeated entries are provided as a courtesy only. Therefore, if you are skipping one or releases, check the release notes of the skipped releases also. If you are only reading the release notes of the current release, you could miss important changes that may affect system behavior. SUSE Edge versions are defined as x.y.z, where 'x' denotes the major version, 'y' denotes the minor, and 'z' denotes the patch version, also known as the "z-stream". SUSE Edge product lifecycles are defined based around a given minor release, e.g. "3.1", but ship with subsequent patch updates through its lifecycle, e.g. "3.1.1".
SUSE Edge z-stream releases are tightly integrated and thoroughly tested as a versioned stack. Upgrade of any individual components to a different versions to those listed above is likely to result in system downtime. While it’s possible to run Edge clusters in untested configurations, it is not recommended, and it may take longer to provide resolution through the support channels.
36.3 Release 3.1.1 #
Availability Date: 15th November 2024
Summary: SUSE Edge 3.1.1 is the first release z-stream in the SUSE Edge 3.1 release stream.
36.3.1 New Features #
The NeuVector version is updated to
5.4.0which provides several new features: Release Notes
36.3.2 Bug & Security Fixes #
The Rancher version is updated to
2.9.3: Release NotesThe RKE2 version is updated to
1.30.5: Release NotesThe K3s version is updated to
1.30.5: Release NotesThe Metal3 chart fixes an issue with the handling of the
predictableNicNamesparameter: SUSE Edge issue #160The Metal3 chart resolves security issues identified in CVE-2024-43803: SUSE Edge issue #162
The Metal3 chart resolves security issues identified in CVE-2024-44082: SUSE Edge issue #160
The RKE2 CAPI provider is updated to resolve an issue where ETCD becomes unavailable on update: RKE2 provider issue #449
36.3.3 Components Versions #
The following table describes the individual components that make up the 3.1.1 release, including the version, the Helm chart version (if applicable), and from where the released artifact can be pulled in the binary format. Please follow the associated documentation for usage and deployment examples. Note that items in bold are highlighted changes from the previous z-stream release.
Name | Version | Helm Chart Version | Artifact Location (URL/Image) |
SLE Micro | 6.0 (latest) | N/A | SLE Micro Download Page |
SUSE Manager | 5.0.0 | N/A | |
K3s | 1.30.5 | N/A | |
RKE2 | 1.30.5 | N/A | |
Rancher Prime | 2.9.3 | 2.9.3 | |
Longhorn | 1.7.1 | 104.2.0+up1.7.1 | |
NM Configurator | 0.3.1 | N/A | |
NeuVector | 5.4.0 | 104.0.2+up2.8.0 | registry.suse.com/rancher/mirrored-neuvector-controller:5.4.0 |
Rancher Turtles (CAPI) | 0.11 | 0.3.3 | registry.suse.com/edge/3.1/rancher-turtles-chart:0.3.3 |
Metal3 | 0.8.3 | 0.8.3 | registry.suse.com/edge/3.1/metal3-chart:0.8.3 |
MetalLB | 0.14.9 | 0.14.9 | registry.suse.com/edge/3.1/metallb-chart:0.14.9 |
Elemental | 1.6.4 | 104.2.0+up1.6.4 | registry.suse.com/rancher/elemental-operator-chart:1.6.4 |
Elemental Dashboard Extension | 2.0.0 | 2.0.0 | |
Edge Image Builder | 1.1 | N/A | registry.suse.com/edge/3.1/edge-image-builder:1.1.0 |
KubeVirt | 1.3.1 | 0.4.0 | registry.suse.com/edge/3.1/kubevirt-chart:0.4.0 |
KubeVirt Dashboard Extension | 1.1.0 | 1.1.0 | registry.suse.com/edge/3.1/kubevirt-dashboard-extension-chart:1.1.0 |
Containerized Data Importer | 1.60.1 | 0.4.0 | registry.suse.com/edge/3.1/cdi-chart:0.4.0 |
Endpoint Copier Operator | 0.2.0 | 0.2.1 | registry.suse.com/edge/3.1/endpoint-copier-operator:v0.2.1 |
Akri (Tech Preview) | 0.12.20 | 0.12.20 | registry.suse.com/edge/3.1/akri-chart:0.12.20 |
SR-IOV Network Operator | 1.3.0 | 1.3.0 | registry.suse.com/edge/3.1/sriov-network-operator-chart:1.3.0 |
System Upgrade Controller | 0.13.4 | 104.0.0+up0.7.0 | System Upgrade Controller chart |
Upgrade Controller | 0.1.0 | 0.1.0 | registry.suse.com/edge/3.1/upgrade-controller-chart:0.1.0 |
36.4 Release 3.1.0 #
Availability Date: 11th October 2024
Summary: SUSE Edge 3.1.0 is the first release in the SUSE Edge 3.1 release stream.
36.4.1 New Features #
Updated to SUSE Linux Micro 6.0, Kubernetes 1.30, and Rancher Prime 2.9
Updated Cluster API and Metal3/Ironic versions
The management cluster CAPI components are now managed via Rancher Turtles
Management cluster upgrades are now managed via Upgrade Controller (Chapter 20, Upgrade Controller)
Stack Validation results are now published at ci.edge.suse.com
nm-configurator is now utilizing nmstate 2.2.36 (upgraded from 2.2.26)
Edge Image Builder enhancements:
Added support for customizing SL Micro 6.0 base images
Added the ability to build aarch64 images on an aarch64 host machine (Tech Preview)
Added the ability to automatically copy files into the built images filesystem
Added the ability to enable FIPS mode
Added caching for container images
Leftover combustion artifacts are now removed on first boot
OS files and user provided certificates now maintain original permissions when copied to the final image
Dependency upgrades
"Phone Home" deployments are now utilizing Elemental v1.6 (upgraded from v1.4)
Embedded registry is now utilizing Hauler v1.0.7 (upgraded from v1.0.1)
Network customizations are now utilizing nm-configurator v0.3.1 (upgraded from v0.3.0)
Image Definition Changes
The current version of the image definition has been incremented to 1.1 to include the changes below
Introduced a dedicated FIPS mode option (enableFIPS) which will enable FIPS mode on the node
Existing definitions using the 1.0 version of the schema will continue to work with EIB
Image Configuration Directory Changes
An optional directory named os-files may be included to copy files into the resulting image’s filesystem at runtime
The custom/files directory may now include subdirectories, which will be maintained when copied to the image
Elemental configuration now requires a registration code in order to install the necessary RPMs from the official sources
36.4.2 Bug & Security Fixes #
The RKE2 CAPI provider now works with cisProfile enabled on SLE Micro: RKE2 provider issue #402
The RKE2 CAPI provider NTP configuration now works on SLE Micro: RKE2 provider issue #436
The RKE2 CAPI provider resolved node drain issue related to rolling upgrades: RKE2 provider issue #431
Edge Image Builder Fixes
Certain Helm charts fail when templated without specified API Versions: EIB issue #481
Large Helm manifests fail to install: EIB issue #491
36.4.3 Components Versions #
The following table describes the individual components that make up the 3.1 release, including the version, the Helm chart version (if applicable), and from where the released artifact can be pulled in the binary format. Please follow the associated documentation for usage and deployment examples.
Name | Version | Helm Chart Version | Artifact Location (URL/Image) |
SLE Micro | 6.0 (latest) | N/A | SLE Micro Download Page |
SUSE Manager | 5.0.0 | N/A | |
K3s | 1.30.3 | N/A | |
RKE2 | 1.30.3 | N/A | |
Rancher Prime | 2.9.1 | 2.9.1 | |
Longhorn | 1.7.1 | 104.2.0+up1.7.1 | |
NM Configurator | 0.3.1 | N/A | |
NeuVector | 5.3.4 | 104.0.1+up2.7.9 | registry.suse.com/rancher/mirrored-neuvector-controller:5.3.4 |
Rancher Turtles (CAPI) | 0.11 | 0.3.2 | registry.suse.com/edge/3.1/rancher-turtles-chart:0.3.2 |
Metal3 | 0.8.1 | 0.8.1 | registry.suse.com/edge/3.1/metal3-chart:0.8.1 |
MetalLB | 0.14.9 | 0.14.9 | registry.suse.com/edge/3.1/metallb-chart:0.14.9 |
Elemental | 1.6.4 | 104.2.0+up1.6.4 | registry.suse.com/rancher/elemental-operator-chart:1.6.4 |
Elemental Dashboard Extension | 2.0.0 | 2.0.0 | |
Edge Image Builder | 1.1 | N/A | registry.suse.com/edge/3.1/edge-image-builder:1.1.0 |
KubeVirt | 1.3.1 | 0.4.0 | registry.suse.com/edge/3.1/kubevirt-chart:0.4.0 |
KubeVirt Dashboard Extension | 1.1.0 | 1.1.0 | registry.suse.com/edge/3.1/kubevirt-dashboard-extension-chart:1.1.0 |
Containerized Data Importer | 1.60.1 | 0.4.0 | registry.suse.com/edge/3.1/cdi-chart:0.4.0 |
Endpoint Copier Operator | 0.2.0 | 0.2.1 | registry.suse.com/edge/3.1/endpoint-copier-operator:v0.2.1 |
Akri (Tech Preview) | 0.12.20 | 0.12.20 | registry.suse.com/edge/3.1/akri-chart:0.12.20 |
SR-IOV Network Operator | 1.3.0 | 1.3.0 | registry.suse.com/edge/3.1/sriov-network-operator-chart:1.3.0 |
System Upgrade Controller | 0.13.4 | 104.0.0+up0.7.0 | System Upgrade Controller chart |
Upgrade Controller | 0.1.0 | 0.1.0 | registry.suse.com/edge/3.1/upgrade-controller-chart:0.1.0 |
36.5 Components Verification #
The components mentioned above may be verified using the Software Bill Of Materials (SBOM) data - for example using cosign as outlined below:
Download the SUSE Edge Container public key from the SUSE Signing Keys source:
> cat key.pem
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7N0S2d8LFKW4WU43bq7Z
IZT537xlKe17OQEpYjNrdtqnSwA0/jLtK83m7bTzfYRK4wty/so0g3BGo+x6yDFt
SVXTPBqnYvabU/j7UKaybJtX3jc4SjaezeBqdi96h6yEslvg4VTZDpy6TFP5ZHxZ
A0fX6m5kU2/RYhGXItoeUmL5hZ+APYgYG4/455NBaZT2yOywJ6+1zRgpR0cRAekI
OZXl51k0ebsGV6ui/NGECO6MB5e3arAhszf8eHDE02FeNJw5cimXkgDh/1Lg3KpO
dvUNm0EPWvnkNYeMCKR+687QG0bXqSVyCbY6+HG/HLkeBWkv6Hn41oeTSLrjYVGa
T3zxPVQM726sami6pgZ5vULyOleQuKBZrlFhFLbFyXqv1/DokUqEppm2Y3xZQv77
fMNogapp0qYz+nE3wSK4UHPd9z+2bq5WEkQSalYxadyuqOzxqZgSoCNoX5iIuWte
Zf1RmHjiEndg/2UgxKUysVnyCpiWoGbalM4dnWE24102050Gj6M4B5fe73hbaRlf
NBqP+97uznnRlSl8FizhXzdzJiVPcRav1tDdRUyDE2XkNRXmGfD3aCmILhB27SOA
Lppkouw849PWBt9kDMvzelUYLpINYpHRi2+/eyhHNlufeyJ7e7d6N9VcvjR/6qWG
64iSkcF2DTW61CN5TrCe0k0CAwEAAQ==
-----END PUBLIC KEY-----Verify the container image hash, for example using crane:
> crane digest registry.suse.com/edge/3.1/baremetal-operator:0.6.1
sha256:cacd1496f59c47475f3cfc9774e647ef08ca0aa1c1e4a48e067901cf7635af8aVerify with cosign:
> cosign verify-attestation --type spdxjson --key key.pem registry.suse.com/edge/3.1/baremetal-operator@sha256:cacd1496f59c47475f3cfc9774e647ef08ca0aa1c1e4a48e067901cf7635af8a > /dev/null
#
Verification for registry.suse.com/edge/3.1/baremetal-operator@sha256:cacd1496f59c47475f3cfc9774e647ef08ca0aa1c1e4a48e067901cf7635af8a --
The following checks were performed on each of these signatures:
- The cosign claims were validated
- The claims were present in the transparency log
- The signatures were integrated into the transparency log when the certificate was valid
- The signatures were verified against the specified public keyExtract SBOM data as described at the upstream documentation:
> cosign verify-attestation --type spdxjson --key key.pem registry.suse.com/edge/3.1/baremetal-operator@sha256:cacd1496f59c47475f3cfc9774e647ef08ca0aa1c1e4a48e067901cf7635af8a | jq '.payload | @base64d | fromjson | .predicate'36.6 Upgrade Steps #
Refer to the Part V, “Day 2 Operations” for details around how to upgrade to a new release.
Below are some technical considerations to be aware of when upgrading from Edge 3.0:
36.6.1 SSH root login on SUSE Linux Micro 6.0 #
In SUSE Linux Micro 5.5 it was possible to SSH as root using password-based authentication, but SUSE Linux Micro 6.0 only key-based authentication is allowed by default.
Systems upgraded to 6.0 from 5.x carry over the old behavior. New installations will enforce the new behavior.
It is recommended to create a non-root user or use key based authentication, but if necessary installing the package openssh-server-config-rootlogin restores the old behavior and allows password-based login for the root user.
36.7 Known Limitations #
Unless otherwise stated these apply to the 3.1.0 release and all subsequent z-stream versions.
Akri is a Technology Preview offering, and is not subject to the standard scope of support.
Edge Image Builder on aarch64 is a Technology Preview offering, and is not subject to the standard scope of support.
36.8 Product Support Lifecycle #
SUSE Edge is backed by award-winning support from SUSE, an established technology leader with a proven history of delivering enterprise-quality support services. For more information, see https://www.suse.com/lifecycle and the Support Policy page at https://www.suse.com/support/policy.html. If you have any questions about raising a support case, how SUSE classifies severity levels, or the scope of support, please see the Technical Support Handbook at https://www.suse.com/support/handbook/.
At the time of publication, each minor version of SUSE Edge, e.g. "3.1" is supported for 12-months of production support, with an initial 6-months of "full support", followed by 6-months of "maintenance support". In the "full support" coverage period, SUSE may introduce new features (that do not break existing functionality), introduce bug fixes, and deliver security patches. During the "maintenance support" window, only critical security and bug fixes will be introduced, with other fixes delivered at our discretion.
Unless explicitly stated, all components listed are considered Generally Available (GA), and are covered by SUSE’s standard scope of support. Some components may be listed as "Technology Preview", where SUSE is providing customers with access to early pre-GA features and functionality for evaluation, but are not subject to the standard support policies and are not recommended for production use-cases. SUSE very much welcomes feedback and suggestions on the improvements that can be made to Technology Preview components, but SUSE reserves the right to deprecate a Technology Preview feature before it becomes Generally Available if it doesn’t meet the needs of our customers or doesn’t reach a state of maturity that we require.
Please note that SUSE must occasionally deprecate features or change API specifications. Reasons for feature deprecation or API change could include a feature being updated or replaced by a new implementation, a new feature set, upstream technology is no longer available, or the upstream community has introduced incompatible changes. It is not intended that this will ever happen within a given minor release (x.z), and so all z-stream releases will maintain API compatibility and feature functionality. SUSE will endeavor to provide deprecation warnings with plenty of notice within the release notes, along with workarounds, suggestions, and mitigations to minimize service disruption.
The SUSE Edge team also welcomes community feedback, where issues can be raised within the respective code repository within https://www.github.com/suse-edge.
36.9 Obtaining source code #
This SUSE product includes materials licensed to SUSE under the GNU General Public License (GPL) and various other open source licenses. The GPL requires SUSE to provide the source code that corresponds to the GPL-licensed material, and SUSE conforms to all other open-source license requirements. As such, SUSE makes all source code available, and can generally be found in the SUSE Edge GitHub repository (https://www.github.com/suse-edge), the SUSE Rancher GitHub repository (https://www.github.com/rancher) for dependent components, and specifically for SLE Micro, the source code is available for download at https://www.suse.com/download/sle-micro on "Medium 2".
36.10 Legal notices #
SUSE makes no representations or warranties with regard to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, SUSE reserves the right to revise this publication and to make changes to its content, at any time, without the obligation to notify any person or entity of such revisions or changes.
Further, SUSE makes no representations or warranties with regard to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, SUSE reserves the right to make changes to any and all parts of SUSE software, at any time, without any obligation to notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classifications to export, re-export, or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical/biological weaponry end uses. Refer to https://www.suse.com/company/legal/ for more information on exporting SUSE software. SUSE assumes no responsibility for your failure to obtain any necessary export approvals.
Copyright © 2024 SUSE LLC.
This release notes document is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License (CC-BY-ND-4.0). You should have received a copy of the license along with this document. If not, see https://creativecommons.org/licenses/by-nd/4.0/.
SUSE has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at https://www.suse.com/company/legal/ and one or more additional patents or pending patent applications in the U.S. and other countries.
For SUSE trademarks, see the SUSE Trademark and Service Mark list (https://www.suse.com/company/legal/). All third-party trademarks are the property of their respective owners. For SUSE brand information and usage requirements, please see the guidelines published at https://brand.suse.com/.