# Rancher Release v2.12.2

**URL:** <https://forums.suse.com/t/rancher-release-v2-12-2/45896>\
**Category:** Announcements\
**Created:** [September 25, 2025, 7:39pm UTC](https://forums.suse.com/t/rancher-release-v2-12-2/45896 "2025-09-25T19:39:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jono-SUSE-Rancher](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/jono-suse-rancher/32/7319_2.png) [@Jono-SUSE-Rancher](https://forums.suse.com/u/Jono-SUSE-Rancher)\
**Post date:** [September 25, 2025, 7:39pm UTC](https://forums.suse.com/t/rancher-release-v2-12-2/45896/1 "2025-09-25T19:39:35Z")

</div>

# Release v2.12.2

> **Important:** If you are using Active Directory Federation Service (AD FS), upgrading to Rancher v2.10.1 or later may cause issues with authentication, requiring manual intervention. These issues are due to the AD FS Relying Party Trust not being able to pick up a signature verification certificate from the metadata. They can be corrected by either of two methods:
> 
> - Updating the Relying Party Trust information from federation metadata (Relying Party Trust → Update from Federation Metadata…)
> - Directly adding the certificate (Relying Party Trust → Properties → Signature tab → Add → Select the certificate).
> 
> For more information see [#48655](https://github.com/rancher/rancher/issues/48655).

> **Important:** [Rancher-Istio](https://ranchermanager.docs.rancher.com/v2.12/integrations-in-rancher/istio) is now deprecated in Rancher v2.12.0; turn to the [SUSE Application Collection](https://apps.rancher.io) build of Istio for enhanced security (included in SUSE Rancher Prime subscriptions). Detailed information can be found in [this announcement](https://forums.suse.com/t/deprecation-of-rancher-istio/45043).

Rancher v2.12.2 is the latest patch release of Rancher. This is a Community and Prime version release that introduces maintenance updates and bug fixes. To learn more about Rancher Prime, see our page on the [Rancher Prime Platform](https://www.rancher.com/products/rancher-platform).

For more information on new features in the general minor release see the [v2.12.0 release notes](https://github.com/rancher/rancher/releases/tag/v2.12.0).

## Changes Since v2.12.1

See the full list of [changes](https://github.com/rancher/rancher/compare/v2.12.1...v2.12.2).

## Security Fixes for Rancher Vulnerabilities

This release addresses the following Rancher security issues:

- Setting the username of one user as the same username of another user causes an error when either user attempts to log in. Therefore, a user with the `Manage Users` permission could potentially deny any user, including admins, from logging in. To prevent this, usernames have been made immutable once set, and it is not possible to update or create a user with a username that is already in use. For more information, refer to [CVE-2024-58260](https://github.com/rancher/rancher/security/advisories/GHSA-q82v-h4rq-5c86).
- The Rancher CLI is modified to print the `requestId` more visibly than as part of the login URL. It also adds a `cli=true` origin marker to the URL. The dashboard is modified to recognize the presence of the `requestId` and uses that to show a warning message to the user, asking for verification that they initiated a CLI login with the related Id. The non-presence of the origin marker enables the dashboard to distinguish between the modified CLI and older CLI’s, and adjust the message accordingly. For more information, refer to [CVE-2024-58267](https://github.com/rancher/rancher/security/advisories/GHSA-v3vj-5868-2ch2)  
.
- `Impersonate-*` headers are removed for requests made through the `/meta/proxy` Rancher endpoint (e.g. when cloud credentials are being created) as the headers may contain identifiable and/or sensitive information. For more information, refer to [CVE-2025-54468](https://github.com/rancher/rancher/security/advisories/GHSA-mjcp-rj3c-36fr)  
.

For more details, see the Security Advisories and CVEs page in Rancher’s [documentation](https://ranchermanager.docs.rancher.com/v2.12/reference-guides/rancher-security/security-advisories-and-cves) or in Rancher’s [GitHub](https://github.com/rancher/rancher/security/advisories) repo.

## Rancher General

### Known Issues

- The [SUSE Customer Center (SCC)](https://scc.suse.com/home) system view has a known issue being investigated regarding duplicate Rancher Manager registrations. See [rancher/scc-operator #38](https://github.com/rancher/scc-operator/issues/38).

## Rancher Webhook

### Major Bug Fixes

- Fixed a race condition when updating a certificate for the Cluster API webhook. See [#44584](https://github.com/rancher/rancher/issues/44584).

# Install/Upgrade Notes

> - If you’re installing Rancher for the first time, your environment must fulfill the [installation requirements](https://ranchermanager.docs.rancher.com/v2.12/getting-started/installation-and-upgrade/installation-requirements).

> **Important:** Rancher now requires the cluster it runs on to have the [Kubernetes API Aggregation Layer](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) enabled. This is because Rancher extends Kubernetes with additional APIs by registering its own extension API server. Please note that all versions of Kubernetes supported in this Rancher versions K8s distributions (RKE2/K3s) will have the aggregation layer configured and enabled by default. Refer to the [Extension API Server documentation](https://ranchermanager.docs.rancher.com/v2.12/api/extension-apiserver#aggregation-layer-is-required) and [#50400](https://github.com/rancher/rancher/issues/50400) for more information.

> **Important:** Rancher Kubernetes Engine (RKE/RKE1) has reached end of life as of **July 31, 2025**. Rancher versions 2.12.0 and later no longer support provisioning or managing downstream RKE1 clusters. We recommend replatforming RKE1 clusters to RKE2 to ensure continued support and security updates. Learn more about the transition [here](https://www.suse.com/support/kb/doc/?id=000021518).
> 
> Rancher now has a pre-upgrade validation check for RKE1 resources which fails and lists the RKE1 resources if present. Refer to the [RKE1 Resource Validation and Upgrade Requirements documentation](https://ranchermanager.docs.rancher.com/v2.12/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/upgrade-docker-installed-rancher#rke1-resource-validation-and-upgrade-requirements-in-rancher-v212) and [#50286](https://github.com/rancher/rancher/issues/50286) for more information.

> **Important:** It is crucial that you review the available disk space on your nodes and plan accordingly before upgrading to Rancher v2.12.0 to avoid potential disk pressure and pod eviction issues. For additional information refer to the [UI Server Side Pagination - Disk Space documentation](https://ranchermanager.docs.rancher.com/v2.12/how-to-guides/advanced-user-guides/ui-server-side-pagination#disk-space).

> **Important:** Rancher now has an enablement option called [`AUDIT_LOG_ENABLED`](https://ranchermanager.docs.rancher.com/v2.12/how-to-guides/advanced-user-guides/enable-api-audit-log#viewing-api-audit-logs:~:text=Description-,AUDIT_LOG_ENABLED,-false%20%2D%20Disables%20the) for API Audit Logs for a Rancher installation. In Rancher versions 2.11.x and earlier, only the `AUDIT_LEVEL` could be set and the default log level (`0`) would disable the audit log. In Rancher versions 2.12.x and later, the default log level (`0`) now only contains the log request and response metadata, and can be set when configuring `AUDIT_LOG_ENABLED`. If installing or upgrading via Helm you can enable the API Audit Logs and specify the log level by applying the following setting to your Helm command: `--set auditLog.enabled=true --set auditLog.level=0`. See the [Enabling the API Audit Log to Record System Events](https://ranchermanager.docs.rancher.com/v2.12/how-to-guides/advanced-user-guides/enable-api-audit-log) documentation and [#48941](https://github.com/rancher/rancher/issues/48941).

## Changes in Image Artifacts

Image artifact digests are renamed in Rancher v2.12.0, v2.11.4 and v2.10.8. Up until this change, separate image digests files for each operating system and architecture have been maintained for compatibility reasons. With this change, only one file for each operating system is to be provided:

- The `rancher-images-digests-linux-amd64.txt` and `rancher-images-digests-linux-arm64.txt` files are to be renamed to `rancher-images-digests-linux.txt`.
- The `rancher-images-digests-windows-ltsc2019.txt` and `rancher-images-digests-windows-ltsc2022.txt` files are to be renamed to `rancher-images-digests-windows.txt`.

# Upgrade Requirements

- **Creating backups:** [Create a backup](https://ranchermanager.docs.rancher.com/v2.12/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-rancher) before you upgrade Rancher. To roll back Rancher after an upgrade, you must first back up and restore Rancher to the previous Rancher version. Because Rancher will be restored to the same state as when the backup was created, any changes post-upgrade will not be included after the restore.
- **Helm version requirements:**
  - To manage Rancher 2.12.x and later, you must upgrade your Helm client to version 3.18 or newer.
  - This change is required to reflect the addition of Kubernetes 1.33 support with this release.
  - Currently, the official [Helm Version Support Policy](https://helm.sh/docs/topics/version_skew/) dictates that only Helm 3.18 supports the proper Kubernetes version range for Rancher 2.12.

- **CNI requirements:**
  - For Kubernetes v1.19 and later, disable firewalld as it’s incompatible with various CNI plugins. See [#28840](https://github.com/rancher/rancher/issues/28840).
  - When upgrading or installing a Linux distribution that uses nf\_tables as the backend packet filter, such as SLES 15, RHEL 8, Ubuntu 20.10, Debian 10, or later, upgrade to RKE v1.19.2 or later to get Flannel v0.13.0. Flannel v0.13.0 supports nf\_tables. See Flannel [#1317](https://github.com/flannel-io/flannel/issues/1317).

- **Requirements for air-gapped environments:**
  - When using a proxy in front of an air-gapped Rancher instance, you must pass additional parameters to `NO_PROXY`. See the [documentation](https://docs.ranchermanager.rancher.io/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher) and issue [#2725](https://github.com/rancher/docs/issues/2725#issuecomment-702454584).
  - When installing Rancher with Docker in an air-gapped environment, you must supply a custom `registries.yaml` file to the `docker run` command, as shown in the [K3s documentation](https://docs.k3s.io/installation/private-registry). If the registry has certificates, then you’ll also need to supply those. See [#28969](https://github.com/rancher/rancher/issues/28969#issuecomment-694474229).

- **Requirements for general Docker installs:**
  - When starting the Rancher Docker container, you must use the `privileged` flag. See [documentation](https://docs.ranchermanager.rancher.io/pages-for-subheaders/rancher-on-a-single-node-with-docker).
  - When upgrading a Docker installation, a panic may occur in the container, which causes it to restart. After restarting, the container will come up and work as expected. See [#33685](https://github.com/rancher/rancher/issues/33685).

# Versions

Please refer to the [README](https://github.com/rancher/rancher#latest-release) for the latest and stable Rancher versions.

Please review our [version documentation](https://docs.ranchermanager.rancher.io/getting-started/installation-and-upgrade/resources/choose-a-rancher-version) for more details on versioning and tagging conventions.

## Images

- rancher/rancher:v2.12.2

## Tools

- CLI - [v2.12.2](https://github.com/rancher/cli/releases/tag/v2.12.2)

## Kubernetes Versions for RKE2/K3s

- v1.33.4 (Default)
- v1.32.8
- v1.31.12

## Rancher Helm Chart Versions

In Rancher v2.6.0 and later, in the **Apps & Marketplace** UI, many Rancher Helm charts are named with a major version that starts with _100_. This avoids simultaneous upstream changes and Rancher changes from causing conflicting version increments. This also complies with semantic versioning (SemVer), which is a requirement for Helm. You can see the upstream version number of a chart in the build metadata, for example: `100.0.0+up2.1.0`. See [#32294](https://github.com/rancher/rancher/issues/32294).

# Previous Rancher Behavior Changes

## Previous Rancher Behavior Changes - Rancher General

- **Rancher v2.12.0:**
  - Kubernetes v1.30 is no longer supported. Before upgrading to Rancher v2.12.0, ensure all clusters are running Kubernetes v1.31 or later. See [#49679](https://github.com/rancher/rancher/issues/49679).

  - The feature flag `ui-sql-cache` (Server-Side Pagination) is now enabled by default in Rancher. Please refer to the [UI Server-Side Pagination](https://ranchermanager.docs.rancher.com/v2.12/how-to-guides/advanced-user-guides/ui-server-side-pagination) document for more information.

## Previous Rancher Behavior Changes - Logging

- **Rancher v2.12.0:**
  - Rancher now has an enablement option called [`AUDIT_LOG_ENABLED`](https://ranchermanager.docs.rancher.com/v2.12/how-to-guides/advanced-user-guides/enable-api-audit-log#viewing-api-audit-logs:~:text=Description-,AUDIT_LOG_ENABLED,-false%20%2D%20Disables%20the) for API Audit Logs for a Rancher installation. In Rancher versions 2.11.x and earlier, only the `AUDIT_LEVEL` could be set and the default log level (`0`) would disable the audit log. In Rancher versions 2.12.x and later, the default log level (`0`) now only contains the log request and response metadata, and can be set when configuring `AUDIT_LOG_ENABLED`. If installing or upgrading via Helm you can enable the API Audit Logs and specify the log level by applying the following setting to your Helm command: `--set auditLog.enabled=true --set auditLog.level=0`. See the [Enabling the API Audit Log to Record System Events](https://ranchermanager.docs.rancher.com/v2.12/how-to-guides/advanced-user-guides/enable-api-audit-log) documentation and [#48941](https://github.com/rancher/rancher/issues/48941).

## Previous Rancher Behavior Changes - Cluster Provisioning

- **Rancher v2.12.0:**
  - Rancher’s `system-upgrade-controller` app is now managed by the `systemchart` handler in downstream provisioned RKE2/K3s clusters. For additional information refer to this [comment](https://github.com/rancher/rancher/issues/47737#issuecomment-3025216088) and see [#47737](https://github.com/rancher/rancher/issues/47737).

  - Rancher v2.12.0 introduces changes in Custom Resource Definition (CRD) validations for `dynamicschemas.management.cattle.io` and dynamically generated CRDs:

## Previous Rancher Behavior Changes - Continuous Delivery (Fleet)

- **Rancher v2.12.0:**
  - A migration patching service account is removed, meaning the image `rancher/kubectl` is no longer needed. See [fleet#3601](https://github.com/rancher/fleet/pull/3601).

# Long-standing Known Issues

## Long-standing Known Issues - Cluster Provisioning

- Not all cluster tools can be installed on a hardened cluster.

- **Rancher v2.12.1:**

- **Rancher v2.8.1:**

- **Rancher v2.7.2:**

## Long-standing Known Issues - RKE2 Provisioning

- **Rancher v2.7.7:**
  - Due to the backoff logic in various components, downstream provisioned K3s and RKE2 clusters may take longer to re-achieve `Active` status after a migration. If you see that a downstream cluster is still updating or in an error state immediately after a migration, please let it attempt to resolve itself. This might take up to an hour to complete. See [#34518](https://github.com/rancher/rancher/issues/34518) and [#42834](https://github.com/rancher/rancher/issues/42834).

- **Rancher v2.7.6:**
  - Provisioning RKE2/K3s clusters with added (not built-in) custom node drivers causes provisioning to fail. As a workaround, [fix](https://github.com/rancher/rancher/issues/37074#issuecomment-1664722305) the added node drivers after activating. See [#37074](https://github.com/rancher/rancher/issues/37074).

## Long-standing Known Issues - K3s Provisioning

- **Rancher v2.7.6:**
  - Provisioning RKE2/K3s clusters with added (not built-in) custom node drivers causes provisioning to fail. As a workaround, [fix](https://github.com/rancher/rancher/issues/37074#issuecomment-1664722305) the added node drivers after activating. See [#37074](https://github.com/rancher/rancher/issues/37074).

- **Rancher v2.7.2:**
  - Clusters remain in an `Updating` state even when they contain nodes in an `Error` state. See [#39164](https://github.com/rancher/rancher/issues/39164).

## Long-standing Known Issues - Rancher App (Global UI)

- **Rancher v2.12.1:**
  - When a standard user with the Cluster Owner role attempts to edit an Azure or AKS cluster, the Machine Pools section shows an error `Cannot read properties of undefined...`. As a workaround, standard users must manually add their cloud credentials to create, edit, and manage Azure or AKS clusters. See [#15241](https://github.com/rancher/dashboard/issues/15241).
  - When registering a Rancher Manager instance with SCC, the **Status** field in the Rancher UI can fail to update. Refresh the page to restore functionality. See [#14985](https://github.com/rancher/dashboard/issues/14985).

- **Rancher v2.10.0:**
  - After deleting a Namespace or Project in the Rancher UI, the Namespace or Project remains visible. As a workaround, refresh the page. See [#12220](https://github.com/rancher/dashboard/issues/12220).

- **Rancher v2.9.2:**
  - Although system mode node pools must have at least one node, the Rancher UI allows a minimum node count of zero. Inputting a zero minimum node count through the UI can cause cluster creation to fail due to an invalid parameter error. To prevent this error from occurring, enter a minimum node count at least equal to the node count. See [#11922](https://github.com/rancher/dashboard/issues/11922).

- **Rancher v2.7.7:**
  - When creating a cluster in the Rancher UI it does not allow the use of an underscore `_` in the `Cluster Name` field. See [#9416](https://github.com/rancher/dashboard/issues/9416).

## Long-standing Known Issues - Hosted Rancher

- **Rancher v2.7.5:**
  - The **Cluster** page shows the **Registration** tab when updating or upgrading a hosted cluster. See [#8524](https://github.com/rancher/dashboard/issues/8524).

## Long-standing Known Issues - EKS

- **Rancher v2.7.0:**
  - EKS clusters on Kubernetes v1.21 or below on Rancher v2.7 cannot be upgraded. See [#39392](https://github.com/rancher/rancher/issues/39392).

## Long-standing Known Issues - Authentication

- **Rancher v2.9.0:**
  - There are some known issues with the OpenID Connect provider support:
    - When the generic OIDC auth provider is enabled, and you attempt to add auth provider users to a cluster or project, users are not populated in the dropdown search bar. This is expected behavior as the OIDC auth provider alone is not searchable. See [#46104](https://github.com/rancher/rancher/issues/46104).
    - When the generic OIDC auth provider is enabled, auth provider users that are added to a cluster/project by their username are not able to access resources upon logging in. A user will only have access to resources upon login if the user is added by their userID. See [#46105](https://github.com/rancher/rancher/issues/46105).
    - When the generic OIDC auth provider is enabled and an auth provider user in a nested group is logged into Rancher, the user will see the following error when they attempt to create a Project: `[``projectroletemplatebindings.management.cattle.io``](``http://projectroletemplatebindings.management.cattle.io/``) is forbidden: User "u-gcxatwsnku" cannot create resource "projectroletemplatebindings" in API group "[``management.cattle.io``](``http://management.cattle.io/``)" in the namespace "p-9t5pg"`. However, the project is still created. See [#46106](https://github.com/rancher/rancher/issues/46106).

## Long-standing Known Issues - Rancher Webhook

- **Rancher v2.7.2:**
  - A webhook is installed in all downstream clusters. There are several issues that users may encounter with this functionality:
    - If you rollback from a version of Rancher v2.7.2 or later, to a Rancher version earlier than v2.7.2, the webhooks will remain in downstream clusters. Since the webhook is designed to be 1:1 compatible with specific versions of Rancher, this can cause unexpected behaviors to occur downstream. The Rancher team has developed a [script](https://github.com/rancher/webhook/wiki/Remove-Webhook-from-downstream-clusters) which should be used after rollback is complete (meaning after a Rancher version earlier than v2.7.2 is running). This removes the webhook from affected downstream clusters. See [#40816](https://github.com/rancher/rancher/issues/40816).

## Long-standing Known Issues - Virtualization Management (Harvester)

- **Rancher v2.7.2:**
  - If you’re using Rancher v2.7.2 with Harvester v1.1.1 clusters, you won’t be able to select the Harvester cloud provider when deploying or updating guest clusters. The [Harvester release notes](https://github.com/harvester/release-notes/blob/main/v1.1.2.md#important-information-about-rancher-support) contain instructions on how to resolve this. See [#3750](https://github.com/harvester/harvester/issues/3750).

## Long-standing Known Issues - Backup/Restore

- When migrating to a cluster with the Rancher Backup feature, the server-url cannot be changed to a different location. It must continue to use the same URL.

- **Rancher v2.7.7:**

---

<div class="post-metadata">

**Author:** ![Jono-SUSE-Rancher](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/jono-suse-rancher/32/7319_2.png) [@Jono-SUSE-Rancher](https://forums.suse.com/u/Jono-SUSE-Rancher)\
**Post date:** [September 25, 2025, 7:39pm UTC](https://forums.suse.com/t/rancher-release-v2-12-2/45896/2 "2025-09-25T19:39:39Z")

</div>