v2.12.8 - Rancher Manager Release Maintenance (#2242 ) (#2253 )

* Update the deprecated features table * Update the CSP adapter compatibility matrix * Update the Rancher:webhook version mapping table * Update the versions table
Merge pull request #2252 from rancher/v2.11.12
2026-09-30 06:54:09 +00:00 · 2026-03-25 20:11:25 -07:00 · 2026-03-25 20:10:45 -07:00 · 2026-03-24 13:28:46 -07:00 · 2026-03-23 23:29:18 +05:30 · 2026-03-23 22:43:55 +05:30
2250 changed files with 95326 additions and 6261 deletions
@@ -1,29 +0,0 @@
-name: Create issue to track porting between Community and Product docs
-
-on:
-  pull_request_target:
-    types:
-      - closed
-    paths-ignore:
-      - '**/README.md'
-
-permissions:
-  issues: write
-  pull-requests: read
-
-jobs:
-  create_issue:
-    if: github.event.pull_request.merged == true && contains( github.event.pull_request.labels.*.name, 'port/community-product')
-    runs-on: ubuntu-latest
-    steps:
-    - name: Create issue
-      env:
-        GH_TOKEN: ${{ github.token }}
-        REPO_TYPE: ${{ contains( github.repository, 'product-docs') && 'Product' || 'Community' }}
-        PR_TITLE: ${{ github.event.pull_request.title }}
-      run: |
-        gh issue create \
-          --repo ${{ github.repository }} \
-          --title "Port $REPO_TYPE docs PR #${{ github.event.pull_request.number }}: $PR_TITLE" \
-          --body "Reference: https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}" \
-          --label port/community-product
@@ -25,7 +25,7 @@ jobs:
        run: yarn install --frozen-lockfile
      - name: Build website
        env:
-          NODE_OPTIONS: "--max_old_space_size=8192"
+          NODE_OPTIONS: "--max_old_space_size=10240"
        run: yarn build --no-minify

      - name: Upload Build Artifact
@@ -27,5 +27,5 @@ jobs:
        run: yarn run remark --quiet --use remark-lint-no-dead-urls ./docs
      - name: Test build website
        env:
-          NODE_OPTIONS: "--max_old_space_size=7168"
+          NODE_OPTIONS: "--max_old_space_size=10240"
        run: yarn build --no-minify
@@ -93,7 +93,7 @@ Subsequent executions will check for updated dependencies, if there are none, it

 License
 =======
-Copyright (c) 2014-2025 [SUSE, LLC.](https://www.suse.com/)
+Copyright (c) 2014-2026 [SUSE, LLC.](https://www.suse.com/)

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -6,10 +6,6 @@ title: Deprecated Features in Rancher
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/faq/deprecated-features"/>
 </head>

-## What is Rancher's deprecation policy?
-
-We have published our official deprecation policy in the support [terms of service](https://rancher.com/support-maintenance-terms).
-
 ## Where can I find out which features have been deprecated in Rancher?

 Rancher will publish deprecated features as part of the [release notes](https://github.com/rancher/rancher/releases) for Rancher found on GitHub. Please consult the following patch releases for deprecated features:
@@ -6,10 +6,6 @@ title: Deprecated Features in Rancher
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/faq/deprecated-features"/>
 </head>

-## What is Rancher's deprecation policy?
-
-We have published our official deprecation policy in the support [terms of service](https://rancher.com/support-maintenance-terms).
-
 ## Where can I find out which features have been deprecated in Rancher?

 Rancher will publish deprecated features as part of the [release notes](https://github.com/rancher/rancher/releases) for Rancher found on GitHub. Please consult the following patch releases for deprecated features:
@@ -65,7 +65,7 @@ Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (heal

 ![](/img/canal-diagram.png)

-For more information, see the [Canal GitHub Page.](https://github.com/projectcalico/canal)
+For more information, refer to the [Rancher maintained Canal source](https://github.com/rancher/rke2-charts/tree/main-source/packages/rke2-canal) and the [Canal GitHub Page](https://github.com/projectcalico/canal).

 #### Flannel

@@ -6,10 +6,6 @@ title: Deprecated Features in Rancher
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/faq/deprecated-features"/>
 </head>

-## What is Rancher's deprecation policy?
-
-We have published our official deprecation policy in the support [terms of service](https://rancher.com/support-maintenance-terms).
-
 ## Where can I find out which features have been deprecated in Rancher?

 Rancher will publish deprecated features as part of the [release notes](https://github.com/rancher/rancher/releases) for Rancher found on GitHub. Please consult the following patch releases for deprecated features:
@@ -96,7 +96,8 @@ To enable draining each node during a cluster upgrade,

 :::note

-There is a [known issue](https://github.com/rancher/rancher/issues/25478) in which the Rancher UI doesn't show the state of etcd and controlplane as drained, even though they are being drained.
+- There is a [known issue](https://github.com/rancher/rancher/issues/25478) in which the Rancher UI doesn't show the state of etcd and controlplane as drained, even though they are being drained.
+- During an upgrade, nodes may be drained even when no user-visible YAML changes are present. This can occur if non-dynamic configuration files are updated or if a new `system-agent-installer` image is introduced. In such cases, Rancher generates a new upgrade plan, resulting in a new plan hash. When `Upgrade Strategy` is set to `Drain nodes`, this plan change can trigger node draining.

 :::

@@ -16,11 +16,15 @@ For configuration details, refer to the [official Kubernetes documentation](http
 <Tabs groupId="k8s-distro">
 <TabItem value="RKE2" default>

-### Method 1 (Recommended): Set `audit-policy-file` in `machineGlobalConfig`
+### Method 1 (Recommended): Set `audit-policy-file` in `machineGlobalConfig` or `machineSelectorConfig`

-You can set `audit-policy-file` in the configuration file. Rancher delivers the file to the path `/var/lib/rancher/rke2/etc/config-files/audit-policy-file` in control plane nodes, and sets the proper options in the RKE2 server.
+You can set `audit-policy-file` in the configuration file using either `machineGlobalConfig` or `machineSelectorConfig`.

-Example:
+When using `machineGlobalConfig`, Rancher delivers the file to the path `/var/lib/rancher/rke2/etc/config-files/audit-policy-file` on **all nodes** (both control plane and worker nodes), and sets the proper options in the RKE2 server. This may cause unwanted worker node reconciliation when the audit policy is modified.
+
+To avoid worker node reconciliation, use `machineSelectorConfig` with a label selector to target only control plane nodes. This ensures that the audit policy file is only delivered to control plane nodes.
+
+Example using `machineGlobalConfig`:
 ```yaml
 apiVersion: provisioning.cattle.io/v1
 kind: Cluster
@@ -38,6 +42,28 @@ spec:
                  - pods
 ```

+Example using `machineSelectorConfig` (recommended to avoid worker node reconciliation):
+```yaml
+apiVersion: provisioning.cattle.io/v1
+kind: Cluster
+spec:
+  rkeConfig:
+    machineSelectorConfig:
+      - config:
+          audit-policy-file: |
+            apiVersion: audit.k8s.io/v1
+            kind: Policy
+            rules:
+              - level: RequestResponse
+                resources:
+                  - group: ""
+                    resources:
+                      - pods
+        machineLabelSelector:
+          matchLabels:
+            rke.cattle.io/control-plane-role: 'true'
+```
+
 ### Method 2: Use the Directives, `machineSelectorFiles` and `machineGlobalConfig`

 :::note
@@ -103,12 +129,6 @@ spec:
            rke.cattle.io/control-plane-role: 'true'
 ```

-:::tip
-
-You can also use the directive `machineSelectorConfig` with proper machineLabelSelectors to achieve the same effect.
-
-:::
-
 For more information about cluster configuration, refer to the [RKE2 cluster configuration reference](../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md) pages.

 </TabItem>
@@ -178,12 +198,6 @@ spec:
            rke.cattle.io/control-plane-role: 'true'
 ```

-:::tip
-
-You can also use the directive `machineSelectorConfig` with proper machineLabelSelectors to achieve the same effect.
-
-:::
-
 For more information about cluster configuration, refer to the [K3s cluster configuration reference](../../reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration.md) pages.

 </TabItem>
--- a/Show More
+++ b/Show More