Kubernetes
v1.33.12Kubernetes Corev1.33.12 is a focused patch release with four kubeadm bug fixes targeting cluster init reliability, etcd health checks, and RBAC hardening for kubelet API access.
enhancementUpgrade kubeadm if you use external load balancers during cluster init
Previously, kubeadm init would write kubeconfigs pointing at the load balancer endpoint, which fails when the LB isn't provisioned until after the first apiserver starts — a chicken-and-egg problem common with cloud providers. The fix makes init use the local API endpoint instead. If you've been working around this with retry scripts or manual kubeconfig edits, this patch removes the need for those hacks.
securityRBAC isolation for kube-apiserver's kubelet client is now enforced
The kube-apiserver now uses a dedicated ClusterRole 'system:kubelet-api-admin' for its kubelet client credentials. This tightens RBAC boundaries and reduces blast radius if credentials are ever misused. No immediate action required for existing clusters, but verify your RBAC audits reflect this role after upgrading kubeadm.
enhancementEtcd quorum-based health check prevents false failures in partially degraded clusters
The old all-members health check would fail kubeadm operations if any etcd member was unhealthy, even when quorum was maintained. Now it only blocks when quorum is actually lost. If you run 3- or 5-node etcd clusters and have hit spurious kubeadm upgrade or join failures due to a single unhealthy member, this patch resolves that.
主な変更 (4)
- kubeadm init now builds in-memory kubeconfigs pointing to localAPIEndpoint instead of controlPlaneEndpoint, fixing failures when load balancers aren't ready at init time
- kubeadm join no longer attempts LocalAPIEndpoint defaulting on worker nodes, removing a source of join failures
- kube-apiserver kubelet client now uses a dedicated ClusterRole 'system:kubelet-api-admin' instead of a shared role
- etcd cluster health check now uses quorum-based evaluation — a degraded but quorum-holding cluster won't block kubeadm operations