EVE-OS 17.0 LTS Release Notes

Updated

Article Published Date: 7/28/2026

The latest 17.0 LTS version is https://github.com/lf-edge/eve/releases/tag/17.0.0-lts 

For a change log between 16.0-lts and 16.0.1-lts, see: https://github.com/lf-edge/eve/compare/16.0.1-lts...17.0.0-lts 

New Features

  • Customizable TPM PCR policies for disk encryption and attestation. EVE-OS now supports flexible TPM PCR policies, allowing administrators to choose exactly which Platform Configuration Registers are measured and enforced when sealing the disk-encryption key on a per-node basis. Sealing policies are delivered from Edge Infrastructure Services dynamically and can be updated without a full system update, providing flexibility for cases where PCR values change for legitimate reasons such as a firmware update.
  • 802.1X network access control with automated SCEP certificate enrollment. EVE-OS now supports IEEE 802.1X port-based network access control, allowing edge devices to authenticate to the network using certificates before being granted access. Certificate enrollment is fully automated via SCEP, including automatic renewal and re-enrollment, with 802.1X status and metrics reported to Edge Infrastructure Services. See the following:
  1. Network Overview
  2. 802.1x Port-based Network Access Control Overview
  3. Configure 802.1x Port-based Network Access Control with Simple Certificate Enrollment Protocol
  • Strict node affinity and configurable failback for EVE-k applications. Applications on ZEDEDA Edge Kubernetes Service clusters can now be pinned strictly to a designated node using a 'required' affinity option, preventing failover to another node for workloads with hardware dependencies or node-locked licensing. Application failback is also now configurable, allowing EVE-k to automatically return a failed-over application to its designated node once it recovers, controlled via the `kubernetes.vmi.deschedule.events` configuration property.
  • VNC remote console access for EVE-k VMs. VM applications running on ZEDEDA Edge Kubernetes Service nodes can now be accessed over VNC via Remote Console and the EdgeView-UI VNC, bringing EVE-k in line with EVE-KVM and removing the previous limitation that required a workaround.
  • CPU pinning for VM applications on EVE-k. ZEDEDA Edge Kubernetes Service now supports CPU pinning for VM applications, matching EVE-KVM: each vCPU is pinned to a dedicated physical CPU thread, giving latency-sensitive workloads exclusive and predictable CPU resources.
  • SR-IOV virtual function passthrough for EVE-k VMs. EVE-k now assigns SR-IOV VFs to KubeVirt VMs using Multus and the SR-IOV CNI/device plugin, so multiple VMs sharing a NIC's VF pool each receive a distinct, dedicated VF with a stable, unique MAC address, replacing the previous approach that could result in duplicate MAC addresses.
  • VM memory-overhead accounting on ZEDEDA Edge Kubernetes Service. VM memory-overhead accounting (VMM overhead) is now supported on ZEDEDA Edge Kubernetes Service, matching EVE-KVM behavior. Memory reserved for the hypervisor is now correctly accounted for when scheduling VM applications, with support for per-app overrides and automatic estimation.
  • Full hardware inventory reporting on connect. EVE-OS devices now report their complete hardware inventory to Edge Infrastructure Services after connecting, including network and IO adapters, PCI and USB devices, CPU, memory, and storage. This enables onboarding without a pre-existing hardware model, so devices can be added even when no matching brand and model is defined in Edge Infrastructure Services. 
    Note: IO adapters (Ethernet and other IO) cannot be referenced from configuration until the device has reported its hardware inventory for the first time.
  • Intel integrated GPU passthrough for EVE-KVM. EVE-KVM now supports Intel integrated GPU (iGPU) passthrough to edge-application VMs, enabling Windows and Linux guests to use the host's Intel iGPU via VFIO for graphics output. A wide range of Intel GPU generations is supported, from Sandy Bridge through Panther Lake.
  • Nvidia Jetpack 7.1 and Thor device support. EVE-OS now supports Nvidia Jetpack 7.1 and the Thor device via a new platform target (`nvidia-jp7`), enabling EVE-OS images to be built and deployed on Nvidia Thor hardware.

Behavioral Changes

  • EVE-k now supports ext4 vault for /persist. ZEDEDA Edge Kubernetes Service now supports an ext4 vault for /persist in addition to ZFS. On a single persist disk, new installations default to ext4, matching the EVE-OS KVM default and keeping ZFS out of the I/O path, while ZFS is still used automatically when multiple persist disks are configured via `eve_persist_disk`. Nodes within a single cluster may use mixed persist types, and existing ZFS-based installations are unaffected.
  • PCIe ACS override disabled on ZEDEDA Edge Kubernetes Service. EVE-k now boots with the PCIe ACS override disabled so IOMMU groups reflect the platform's real hardware topology, improving isolation accuracy and hardware certification. Operators using PCI passthrough configurations that relied on the override to split shared IOMMU groups should review those assignments, and hardware models used with EVE-k should be regenerated against an EVE-k node.
  • Larger disk partitions for new EVE-OS installations. Starting with release 17.0, new EVE-OS installations for both EVE-KVM and EVE-k use a larger unified partition layout requiring approximately 24 GB of disk, with a 2 GB EFI system partition and two 10 GB root-filesystem partitions for the A/B update pair. This change affects new installations only; upgraded devices keep their existing partition layout. All EVE-k deployments should be installed fresh from EVE 17 to ensure the new disk layout. 

Enhancements

ZEDEDA Edge Kubernetes Service

  • Per-node k3s configuration override. Added the `k3s.config.override` configuration property, allowing operators to override the k3s configuration on a per-node basis.
  • Per-node k3s version override. Added the `k3s.version` configuration property, allowing the installed k3s version to be overridden on a per-node basis.
  • Cluster registration manifest support on EVE-k. Added support for the cluster registration manifest in both base and replicated-storage modes on EVE-k.
  • On-demand application image downloads on EVE-k. On ZEDEDA Edge Kubernetes Service clusters, application images are no longer downloaded to every node, reducing unnecessary bandwidth and storage usage.
  • Faster application failover on ZEDEDA Edge Kubernetes Service clusters. Application failover speed on ZEDEDA Edge Kubernetes Service clusters has been improved, reducing downtime when a node becomes unavailable.
  • Improved node readiness on ZEDEDA Edge Kubernetes Service clusters. k3s options have been tuned to improve node readiness timing on ZEDEDA Edge Kubernetes Service clusters, reducing startup delays.
  • Local-path storage enabled for single-node ZEDEDA Edge Kubernetes Service deployments. Local-path storage is now available for single-node and base ZEDEDA Edge Kubernetes Service deployments, expanding persistent storage options without requiring a multi-node cluster.
  • Virtio device support added for KubeVirt VMs on ZEDEDA Edge Kubernetes Service. KubeVirt VMs on ZEDEDA Edge Kubernetes Service now support virtio devices, enabling improved I/O performance and broader guest compatibility.
  • Edge Infrastructure Services-driven load balancer for K3S_BASE clusters. A kube-vip load balancer, managed through Edge Infrastructure Services, is now available for K3S_BASE clusters, improving traffic distribution and high-availability networking.
  • Manual k3s control commands for EVE-k nodes. New operator commands (`k3s-stop`, `k3s-start`, `k3s-status`) allow stopping and restarting k3s on a ZEDEDA Edge Kubernetes Service node without disrupting EVE-OS automatic restart supervision, useful for operations such as releasing the etcd lock during a cluster restore.
  • EVE-k reports etcd snapshot and rollback capability for Kubernetes clusters. EVE-k now surfaces etcd snapshot and rollback capability for Kubernetes clusters to Edge Infrastructure Services, giving operators visibility into cluster recovery options.
  • Faster application failover on EVE-k. Application failover speed on ZEDEDA Edge Kubernetes Service clusters has been improved by reducing the time spent migrating volumes.
  • Simultaneous cluster node reboots now supported on EVE-k. ZEDEDA Edge Kubernetes Service now supports rebooting all cluster nodes at the same time by skipping pod eviction when a cluster-wide drain is detected, preventing nodes from blocking on each other during coordinated reboots.
  • Staggered k3s startup improves ZEDEDA Edge Kubernetes Service cluster boot reliability. EVE-k nodes now stagger k3s startup using a persisted control-plane rank, reducing contention and improving reliability when a cluster boots.
  • Kubernetes cluster reporting for single-node ZEDEDA Edge Kubernetes Service deployments. EVE-k now reports Kubernetes cluster information for single-node ZEDEDA Edge Kubernetes Service deployments, not only multi-node clusters, giving operators consistent cluster visibility regardless of deployment size.
  • Reserved storage on ZEDEDA Edge Kubernetes Service nodes set to 2 GB. Reserved storage on ZEDEDA Edge Kubernetes Service nodes is now set to 2 GB, ensuring adequate headroom for cluster operations.
  • Periodic etcd auto-compaction on ZEDEDA Edge Kubernetes Service clusters. Hourly auto-compaction of the etcd database is now enabled on ZEDEDA Edge Kubernetes Service clusters, keeping k3s stable on devices with slower disks and preventing stalls caused by an uncompacted etcd.
  • Longhorn storage improvements on ZEDEDA Edge Kubernetes Service. Several ZEDEDA Edge Kubernetes Service storage improvements include tuned replica rebuild to favor fast delta resync over full rebuilds after simultaneous node power cycles, capped concurrent rebuilds to protect disk I/O, enabled auto-salvage for faulted volumes, added recurring snapshot management, and fixed replica and PVC size reporting.
  • Network download cost enforcement for container image pulls on ZEDEDA Edge Kubernetes Service. On ZEDEDA Edge Kubernetes Service clusters, outbound HTTPS used for container image and manifest pulls now respects the configured network download cost setting. When the lowest-cost uplink's gateway is unreachable, image pulls automatically use a healthy higher-cost uplink instead of failing.
  • Cloud-init support for container applications on EVE-k. Container (shim) applications on EVE-k now receive their cloud-init environment variables and mounted volumes, matching the behavior of native VM applications.

Networking

  • TCP MSS clamping for forwarded app traffic. Automatic clamping of TCP Maximum Segment Size for forwarded application traffic based on the path MTU, preventing fragmentation and dropped packets. This can be disabled using the `app.enable.tcp.mss.clamping` configuration property.
  • Interleaved DNS server ordering for multi-interface devices. EVE-OS now interleaves DNS servers from different network interfaces when building `resolv.conf`, ensuring each uplink is represented among the first entries and improving DNS resolution reliability on devices with multiple uplinks.
  • Per-interface route metrics via dhcpcd for better interface selection. Introduces per-interface route metrics via dhcpcd to improve interface selection for non-policy-based routing, for example when pulling Kubernetes system images, with metrics preferring lower-cost management ports.
  • Per-interface route metrics extended to cellular interfaces. Extends per-interface route metrics to cellular (modem) interfaces, ensuring device traffic prefers lower-cost management ports over cellular connections.
  • Device-bound MAC address on network instances. Supports configuring a device-bound MAC address on network instances, providing stable MAC addressing tied to the device.
  • SR-IOV support validated on Intel I350 NIC. SR-IOV support has been validated on the Intel I350 NIC, and a mismatch in the Edge Infrastructure Services-facing SR-IOV API behavior has been corrected.
  • Physical network interfaces supported in NOHYPE container applications. Reduced Isolation (NOHYPE) container applications can now receive physical network interfaces via AppDirect adapter assignment, enabling direct L2 access for industrial protocols such as EtherCAT and PROFINET.
  • Fixed bond creation and failover link monitoring. A bug causing 802.3ad (LACP) bond creation to fail with an access error due to a spurious ARP interval parameter in the netlink message has been fixed. For failover bond modes, MII link monitoring is now automatically enabled with a 100 ms interval when no monitoring method is explicitly configured.
  • Richer link aggregation (LAG) status reporting. EVE-OS now reports detailed bond runtime status to Edge Infrastructure Services, including bond mode, active member, MII/ARP link monitoring, LACP state, and per-member metrics such as link-failure counts and LACP churn, giving operators full visibility into LAG health from the management platform.
  • Local Profile Server (LPS) improvements. This release significantly improves the Local Profile Server, an on-site service for managing edge devices in air-gapped deployments: configuration notifications now arrive in under 2 seconds (down from up to 60 seconds), EVE-OS reports richer per-port network status on each update, and operators receive clear feedback about which ports LPS is permitted to reconfigure.
  • Bond ARP monitoring gateway failure detection fix. Bonds with ARP monitoring now correctly detect gateway failures in multi-node cluster setups, where cross-node ARP traffic could previously mask a broken path and suppress failover.

Trusted Platform Module & Security

  • Security update: multiple dependency CVE patches. EVE-OS updated bundled dependencies and applied kernel CVE patches to address known vulnerabilities in golang.org/x/crypto, go-jose, zlib, the Rust `time` crate, dnsmasq, nvidia-container-toolkit, and runc/containerd, along with kernel security fixes.
  • Cryptographically secure initialization-vector generation. Replaced MD5-based initialization-vector generation with a cryptographically secure random source, strengthening encryption key material handling.
  • Stronger internal message encryption. Authenticated encryption (AES-GCM) now in use with HKDF key derivation for internal messages, replacing a weaker encryption scheme.
  • Constant-time security comparison. A security-sensitive comparison has been hardened by using a constant-time check to prevent timing-based side-channel attacks.
  • Automated TLS root CA certificate updates. EVE-OS now ships the latest root CA certificates from Alpine Linux and automatically updates them with each EVE-OS release, keeping TLS trust anchors current.
  • Improved TPM boot failure diagnostics. GRUB now includes the raw EFI status code in the 'Unknown TPM error' message, making it easier to diagnose and troubleshoot TPM-related boot failures.
  • Encrypted CPU-TPM bus communication for disk key seal/unseal. Disk encryption key seal and unseal operations now use AES-128-CFB encryption on the CPU-TPM bus to prevent passive bus snooping, with automatic fallback for TPMs that do not support AES.

EdgeView

  • EdgeView script expiry time display. EdgeView now shows the script expiry time in a human-readable format.
  • Certificate validation for EdgeView connections. EdgeView connections now enforce certificate validation, improving the security of remote access sessions.
  • EdgeView signing certificate storage path updated. EdgeView now stores the Edge Infrastructure Services signing certificate under /run/edgeview/ instead of /persist/certs/, following the removal of the on-disk certificate copy.

Storage & Partitions

  • Storage devices with non-standard sector sizes now supported. EVE-OS now supports storage devices with non-default (non-512-byte) sector sizes, broadening compatibility with modern and enterprise-grade storage hardware.
  • CONFIG partition tmpfs mount size increased to 1 MB. The CONFIG partition tmpfs mount size has been increased from 256 KB to 1 MB to match the physical partition size, preventing data truncation on devices with larger configuration payloads.
  • CONFIG partition size increased to 5 MB. The CONFIG partition size has been increased from 1 MB to 5 MB to accommodate more configuration files in the future.
  • New GRUB option to disable DIRSYNC for improved VM I/O performance. A new GRUB option (`eve_no_dirsync`) allows disabling DIRSYNC for /persist and the vault; DIRSYNC remains enabled by default on bare metal, but disabling it is recommended when EVE-OS runs as a VM to improve I/O performance.

Cellular & Wireless

  • Intel WiFi firmware added. The following firmware has been added: 
    • Intel Wi-Fi 6E AX211 (iwlwifi-ma-b0-gf4-a0) for ASUS NUC14SRK and similar Meteor Lake devices.
    • Intel Wi-Fi 6E AX1690i/AX211 (iwlwifi-so-a0-gf4-a0) for Intel NUC12SNKi7 and similar Alder Lake devices.
    • Intel AX210 Wi-Fi adapter, enabling Wi-Fi on devices using this adapter.

Hardware

  • Per-VM USB boot order control. Operators can now configure whether each VM prioritizes or deprioritizes USB devices in its boot order, with the setting taking effect on the next VM restart.
  • Disk LED enforcement removed. EVE-OS no longer enforces disk I/O operations to signal status through the disk activity LED on devices without a dedicated status LED, eliminating unnecessary I/O overhead on such hardware.
  • Raspberry Pi 4 and 5 fixes. Several fixes for Raspberry Pi 4 and 5 include updated U-Boot and Raspberry Pi firmware, an updated TPM device-tree overlay, and a fix to avoid loading an incorrect kernel device tree on the Raspberry Pi 4B.

NVIDIA Platforms

  • Initial firmware TPM (fTPM) support on SecEdge devices. EVE-OS now includes the OP-TEE client libraries and tee-supplicant daemon required by a firmware TPM, providing the foundation for using a built-in fTPM as a hardware root of trust on SecEdge hardware without a discrete TPM chip.

Linux OS & Kernel Updates

  • NUMA and NUMA-balancing kernel support added. The kernel now supports NUMA and NUMA-balancing, enabling better memory locality and performance on multi-socket or NUMA-capable edge hardware.
  • Kernel ring buffer increased to 2 MB. The kernel ring buffer has been increased from 128 KB to 2 MB, preventing the loss of early boot messages on systems with many PCI devices or under heavy load.
  • ACRN hypervisor support removed. Support for the ACRN hypervisor has been removed from EVE-OS; operators using ACRN should migrate to a supported hypervisor.
  • Kernel updates across supported architectures. Kernel updates have been applied across supported architectures (amd64, arm64, NVIDIA JetPack 5/6/7, and riscv64).

Observability

  • GPT partition identity in storage reporting. Device storage reporting now includes GPT partition identity (label, type GUID, and PARTUUID), so Edge Infrastructure Services can identify partitions by role and read their sizes.

General

  • Error message for shared file-based volume between apps. EVE-OS now displays a proper error message when a user attempts to share a file-based volume between applications.
  • Resumable downloads from HTTP datastores. HTTP datastore downloads can now resume after a reboot or interruption, so an interrupted download of a large Edge App image continues from where it left off instead of restarting from the beginning. No application configuration changes are required.
  • Improved hardware device detection during installation. EVE-OS now more reliably detects hardware devices during the installation process.
  • Higher-resolution VNC consoles on KVM guests. Virtual machines with VNC enabled now use a virtio-vga display device on x86 (virtio-gpu-pci on ARM) instead of legacy VGA, removing the previous 16 MB video-memory limit and enabling higher-resolution remote console sessions. Guests without a virtio-gpu driver continue to work at standard resolution
  • New `eve app` subcommands for managing applications by display name. New commands `eve app list`, `eve app enter`, and `eve app console` allow operators to manage edge applications using display names instead of container GUIDs, with improved status reporting and automatic shell detection. Old commands are kept as deprecated aliases for backward compatibility.
  • Automatic EFI boot entry creation during installation. The EVE-OS installer now creates an EFI NVRAM boot entry during installation, so EFI-capable devices automatically boot into EVE-OS after install without manual firmware configuration.
  • HTTP/HTTPS datastore authentication support. Application image downloads from HTTP/HTTPS datastores now support Basic, Bearer, and NTLM authentication, allowing images to be hosted on authenticated web servers.
  • Custom CA certificate support for OCI registry downloads. Application image downloads from OCI registry datastores now apply the datastore's custom CA certificates when resolving the registry, so private or self-signed OCI registries work correctly.

Troubleshooting

  • EdgeSync upload update. EVE-OS now retries collect-info diagnostic bundle uploads using PUT when an initial POST request is rejected by the destination server, ensuring compatibility with servers such as WebDAV that require PUT for file uploads.
  • Internal Memory Monitor for continuous leak detection. The Internal Memory Monitor (IMM) now runs continuously to detect abnormal upward memory trends and outputs a 0-10 risk score that rises with sustained growth and falls back when usage stabilizes. Results are recorded in system logs and included in collect-info for troubleshooting, and the feature is enabled by default with no action required.

Resolved Issues & Bug Fixes

  • Improved application failover. On ZEDEDA Edge Kubernetes Service clusters, EVE-k now reports an application as UNKNOWN instead of BROKEN when the Kubernetes API server is temporarily unreachable during scheduling decisions. This prevents Edge Infrastructure Services from halting recovery attempts prematurely, improving application failover reliability.
  • ZEDEDA Edge Kubernetes Service node-UUID label fix and log rotation correction. Fixed an issue where a change to a node's device UUID prevented the `node-uuid` label from being reapplied on ZEDEDA Edge Kubernetes Service clusters, which could lead to further cluster problems. Also corrected the file path used for `k3s.log.restart` log rotation.
  • ZEDEDA Edge Kubernetes Service cluster status published over large-message channel. On ZEDEDA Edge Kubernetes Service clusters, cluster status information including pods, VMIs, volumes, and replicas is now published over the large-message pubsub channel, preventing failures when this data exceeds the standard 64 KB message-size limit on larger clusters.
  • ZEDEDA Edge Kubernetes Service: persistent EFI boot state for VMs disabled to prevent recurring restarts. On ZEDEDA Edge Kubernetes Service clusters, persistent EFI boot state for VMs has been disabled because it required an RWX volume not yet supported on EVE-k, which caused the KubeVirt virt-launcher pod to crash periodically and restart affected VMs every few hours. Disabling it eliminates these recurring VM restarts.
  • Improved application failover on ZEDEDA Edge Kubernetes Service clusters. EVE-OS delivers more reliable application failover on ZEDEDA Edge Kubernetes Service clusters, including improved behavior in tie-breaker cluster configurations.
  • ZEDEDA Edge Kubernetes Service: KubeVirt operator deletion no longer blocks cluster operations. On ZEDEDA Edge Kubernetes Service clusters, deletion of the KubeVirt operator now completes in the background, avoiding extended stalls during cluster teardown.
  • Edge-node cluster status token fix. Fixed an issue where edge-node cluster status could be reported to Edge Infrastructure Services without the required authentication token.
  • ZEDEDA Edge Kubernetes Service cluster-join fix for k3s v1.34. Fixed a cluster-join regression introduced with k3s v1.34, which removed a deprecated node label that EVE-k previously required before advertising cluster status, so nodes now join and report status correctly.
  • More resilient ZEDEDA Edge Kubernetes Service component upgrades. The cluster-init process can now recover by restarting k3s if it stops during a component update, and a default timeout was added to prevent the upgrade from stalling indefinitely.
  • VM workload log collection fix on EVE-k. Fixed an issue with log collection from VM workloads on EVE-k.
  • Container workload log collection fix on EVE-k. Fixed an issue with log collection from container (shim/VMI) workloads on EVE-k.
  • ZEDEDA Edge Kubernetes Service node and cluster deletion more resilient. Node and cluster deletion on EVE-k now safely skips the node drain step and proceeds if the Longhorn replica list cannot be retrieved, for example when the replica CRD is missing, preventing deletion from stalling.
  • KubeVirt backwards-compatibility issue on EVE-k fixed. A KubeVirt backwards-compatibility issue has been resolved, ensuring consistent behavior across cluster upgrades.
  • Source-IP selection fixed on EVE-k. A bug where the cluster IP was used as the source address for outbound device connections on ZEDEDA Edge Kubernetes Service clusters has been fixed, ensuring correct routing for external traffic.
  • k3s restart on EVE-k fixed. A stale flannel network interface is now removed before restarting k3s on ZEDEDA Edge Kubernetes Service nodes, preventing restart failures caused by interface conflicts.
  • Fixed IP address loss on EVE-k application restart. A race condition that could cause an EVE-k application to lose its IP address upon restart has been resolved.
  • Fixed edge node clustering with logical label interface specification. An issue where edge node clustering failed when the cluster interface was specified by logical label has been resolved.
  • Fixed cluster load balancing with logical label interface specification. An issue where cluster load balancing failed when the interface was specified by logical label has been resolved.
  • Fixed purge collisions for KubeVirt VM applications on EVE-k. Purge and update operations for KubeVirt VM applications on ZEDEDA Edge Kubernetes Service clusters now complete reliably, resolving collisions that previously caused these operations to fail.
  • Fixed multiple bugs in the Kubernetes leader election state machine. Several reliability issues in the Kubernetes leader election state machine have been fixed, including stale TLS clients after certificate rotation, boot-time race conditions, retry deadlocks, and data races. The state machine has been simplified to improve stability.
  • Fixed stale CPU-manager state file preventing k3s startup. A stale Kubelet CPU-manager state file could prevent k3s from starting after a CPU-manager policy change between releases. The state file is now cleared on each reboot so it is always regenerated from the current configuration.
  • Restored k3s v1.34+ compatibility with host-local IPAM plugin. Compatibility with k3s v1.34 and greater has been restored by ensuring the host-local IPAM plugin is available on the system PATH.
  • Fixed EVE-k cluster-delete regression. Deleting a ZEDEDA Edge Kubernetes Service cluster now correctly returns all nodes to single-node mode, resolving a regression that left nodes in an incorrect state after cluster deletion.
  • Kubernetes API call timeouts added on EVE-k. Kubernetes API calls on EVE-k are now bounded by a timeout, preventing the agent watchdog from triggering incorrectly if the API becomes unresponsive.
  • Improved Longhorn storage performance on EVE-k via iSCSI queue depth tuning. Storage performance on ZEDEDA Edge Kubernetes Service clusters has been improved by tuning iSCSI queue depth per disk type (SSD, NVMe, HDD), replacing a prior default of 1 that limited throughput for clustered Longhorn storage.
  • Load-balancer CIDR conflict detection on EVE-k. ZEDEDA Edge Kubernetes Service now detects load-balancer CIDR conflicts and correctly filters virtual IPs, preventing misrouted traffic in clustered deployments.
  • Fixed ECDH certificate blocking k3s startup on EVE-k. Fixed an issue where a missed ECDH certificate during Kubernetes startup could prevent k3s from starting on ZEDEDA Edge Kubernetes Service nodes, improving cluster startup reliability.
  • Improved KubeVirt application recovery on EVE-k. Improved recovery of KubeVirt applications on ZEDEDA Edge Kubernetes Service clusters, including handling of VMs that become stuck in the Pending state, reducing manual intervention during application failures.
  • Fixed Longhorn readiness reporting race condition on EVE-k. Fixed a race condition in Longhorn readiness reporting on ZEDEDA Edge Kubernetes Service clusters that could cause inaccurate storage status.
  • EVE-k auto-recover k3s after reboot. ZEDEDA Edge Kubernetes Service nodes now always restart k3s after a reboot: the manual k3s-stop flag is stored on temporary storage, so a reboot clears it and k3s recovers automatically without operator intervention.
  • Standalone containerd auto-restarts on EVE-k. On ZEDEDA Edge Kubernetes Service nodes, the standalone containerd runtime now automatically restarts if it stops, for example due to an out-of-memory condition, preventing the node from being unable to start k3s.
  • KubeVirt updated to 1.7.3 on EVE-k. KubeVirt has been updated to version 1.7.3, incorporating a fix for VM readiness reporting.
  • Improved application status accuracy on EVE-k. Application status accuracy on ZEDEDA Edge Kubernetes Service clusters has been improved by reporting status from cluster data when no pod is present on the local node, ensuring operators see correct application state.
  • Fixed initialization loop when converting ZEDEDA Edge Kubernetes Service node to clustered mode. Fixed an issue where an EVE-k node converting from single-node to clustered mode on ZEDEDA Edge Kubernetes Service could get stuck in an initialization loop and fail to complete startup.
  • Fixed stale session file blocking VNC console on EVE-k VMs. Fixed an issue where a stale session file could block new VNC console sessions to EVE-k VMs, restoring reliable remote console access.
  • Fixed KubeVirt VM ReplicaSet cleanup on EVE-k. Fixed cleanup of KubeVirt VM ReplicaSets when a ZEDEDA Edge Kubernetes Service application is purged or restarted, preventing stale resources from interfering with subsequent deployments.
  • Fixed KubeVirt CPU metrics on EVE-k. Fixed an issue where KubeVirt CPU metrics on ZEDEDA Edge Kubernetes Service were always reported as zero, restoring accurate CPU utilization visibility for VM workloads.
  • Clustered application status and failback fix. Fixed an application-status reporting race and a stuck failback condition for clustered applications on EVE-k, ensuring accurate status reporting and reliable failback to designated nodes.
  • Stale etcd lease cleanup. EVE-k now cleans up stale etcd master leases after a node transitions from single-node to clustered mode, preventing stale state from interfering with cluster operations.
  • Stale master node pruning. EVE-k now prunes stale master nodes from the edge node cluster configuration, preventing stale entries from causing cluster inconsistencies.
  • Stale storage mount cleanup daemon. Added a stale-mount-cleanup daemon on EVE-k nodes that removes stale storage mounts left behind after volume auto-salvage, preventing application pods from becoming permanently stuck in ContainerCreating.
  • VM state reporting fix during initialization. Fixed VM state reporting on EVE-k during the initialization phase, including corrected stuck-state detection, so VM applications are reported accurately while starting up.
  • Longhorn readiness wait for volume preparation. On EVE-k, volume preparation now waits for Longhorn to be ready before performing CSI volume operations, preventing failures when a volume is requested before the storage layer is up.
  • Longhorn replica and rebuild status reporting fix. Fixed Longhorn replica-mode and rebuild-status reporting on EVE-k by correcting an internal key format, so replica and rebuild state is reported accurately.
  • EdgeView TCP and Kubernetes session port assignment fix. Fixed a bug where EdgeView TCP and Kubernetes (`kube`) sessions could be assigned an incorrect port number when EdgeView runs as a single instance, preventing those sessions from connecting.
  • EdgeView session-encryption fix. Fixed a session-encryption issue in EdgeView that could affect the security of remote access connections.
  • Strengthened EdgeView filename validation. EdgeView now enforces stricter filename validation to prevent access to unintended files, reducing the risk of unauthorized file exposure during diagnostic sessions.
  • Cellular interface visible in EdgeView. Fixed an issue where the cellular (wwan0) interface was missing from the EdgeView available interface list, so operators can now inspect and manage cellular connectivity through EdgeView.
  • Fixed EdgeView signing-certificate file cleanup. Fixed an issue with removal of the EdgeView signing-certificate file, preventing stale certificate files from accumulating on the device.
  • Maintenance mode on lost /persist partition. If a device loses its /persist partition and therefore its edge node certificates, EVE-OS now places the device in maintenance mode on the next boot rather than silently regenerating certificates that Edge Infrastructure Services would reject.
  • S.M.A.R.T. reporting fix: per-attribute threshold values now included. Fixed S.M.A.R.T. reporting for storage devices so that per-attribute threshold values are now included in the hardware information sent to Edge Infrastructure Services and displayed correctly in the UI.
  • Fix for oversized device port configuration messages. Fixed an issue where large or complex device port (network) configurations could produce oversized internal JSON messages, potentially disrupting network configuration handling. Empty fields are now omitted from the device port configuration, keeping messages within size limits and allowing more sophisticated network configurations.
  • Cluster status token fix. Fixed an issue on EVE-k where the edge node cluster status could be published to Edge Infrastructure Services without the required token. The status is now re-published whenever an updated Edge Infrastructure Services certificate is received.
  • Immediate app re-activation after snapshot rollback. Fixed an issue where edge applications were not re-activated immediately after rolling back from a snapshot; affected apps now restart promptly.
  • Getty login fix for serial-port consoles with format suffix. Fixed getty login on serial-port consoles where a console speed parameter with a format suffix, for example `console=ttyS0,115200n8`, could cause getty to fail to start and enter a continuous restart loop. The suffix is now handled correctly.
  • Corrected memory-overhead accounting for passthrough adapter applications. Fixed memory-overhead accounting for applications with directly attached (passthrough) adapters, which was previously underestimated and could allow an application to start without enough memory. EVE-OS now prevents starting such an application when memory is insufficient, and the memory estimate can be adjusted via the VMM overhead setting if needed.
  • Root filesystem fix for VM-wrapped container applications. Fixed the root filesystem setup for VM-wrapped container applications by mounting it as an overlay, ensuring correct behavior at runtime.
  • EdgeView 'Reboot reason' command fix. Fixed the 'Reboot reason' command in EdgeView, which could fail due to log-file permission errors.
  • Edge Infrastructure Services connection handling improvement. Improved connection handling in the Edge Infrastructure Services communication layer for more reliable device-to-controller communication.
  • VM fast-reboot stability fix. Fixed a potential system degradation that could occur during fast VM reboots.
  • Improved EVE-OS installation error messages. An error message in the EVE-OS installation logs has been improved to provide clearer diagnostics when installation issues occur.
  • Empty path segment handling in download URLs. Fixed handling of empty path segments in edge application download URLs, preventing failures when downloading application images from datastores with such URLs.
  • ANSI escape code stripping in logs fixed. EVE-OS now correctly strips ANSI escape codes from log output, ensuring clean, readable log entries.
  • CPU info parsing crash fixed. A crash caused by incorrect parsing of `/proc/cpuinfo` on certain CPUs has been resolved, improving stability on a wider range of hardware.
  • Application no longer stuck in HALTING state during purge. An issue where an application instance could become permanently stuck in the HALTING state during a purge operation has been fixed; the purge state machine now always advances to completion.
  • Fixed HTTP datastore downloads with Azure SAS tokens. A regression that caused application image downloads from HTTP datastores using Azure SAS tokens to fail with HTTP 409 has been fixed. The SAS query string is now correctly preserved when constructing the download URL.
  • Fixed bootstrap configuration onboarding failure. A regression where devices using a baked-in bootstrap configuration (single-use installer) could fail to onboard with a 'failed to acquire ECDH cert' error has been fixed. Bootstrap configuration loading no longer incorrectly requires an ECDH certificate.
  • License UUID retained across application failover. Applications that bind their license to the VM firmware UUID now retain that license after failover, because EVE-OS consistently uses the application UUID as the firmware UUID. Disabling an application's logs now also stops its guest-console container so log output is fully suppressed.
  • Fixed Windows guest compatibility with Active Directory under FML virtualization. Fixed an issue where Windows guests with Active Directory failed under FML virtualization mode; EVE-OS no longer passes the VMX CPU flag to the guest, resolving the incompatibility.
  • Log rotation for software TPM. Added log rotation for the software TPM (swtpm) to prevent unbounded log growth on devices using a software-emulated TPM.
  • Fixed volume-manager timer minimum interval. Fixed a bug where the volume-manager timer could be set below one second, which could cause excessive polling and resource usage.
  • OpenStack metadata sub-path fix. Fixed the metadata server so that OpenStack metadata sub-paths (such as `/openstack/latest/meta_data.json`) are correctly served, allowing VMs using cloud-init's OpenStack data source to retrieve their metadata, user-data, and network configuration.
  • Non-Latin-1 app name reboot loop fix. Fixed a newlogd reboot loop that occurred on devices running an application whose name contained non-Latin-1 characters, for example CJK, emoji, or smart quotes, preventing continuous restarts in those environments.
  • URL query-parameter encoding fix. Fixed query-parameter encoding in URLs used to reach datastores and Edge Infrastructure Services, preventing malformed requests caused by incorrectly encoded query strings.
  • Early-boot log level configuration fix. Fixed an issue where, after a reboot, the device could ignore the configured log levels during early boot and briefly send logs to Edge Infrastructure Services at the default level even when set to `none`. Log level settings are now cached locally and applied from the first log message at startup.
  • Improved application networking reliability during redeployment. EVE-OS improves reliability of application networking during app replacement or redeployment, and prevents DNS/DHCP configuration conflicts when multiple applications attempt to use the same display name.
  • VLAN sub-interface dependency handling fix. Fixed dependency handling for VLAN sub-interfaces, ensuring network configuration changes are applied in the correct order.
  • IPv6 address assignment prevention on IPv4-only networks. Fixed dhcpcd arguments to prevent IPv6 addresses from being assigned when using static IPv4 on IPv4-only networks.
  • Application re-activation during purge fixed. An "already connected" error that could prevent an application from re-activating during a purge while its previous network teardown was still completing has been resolved.
  • Network traces now exported completely. Network-trace handling has been fixed so that traces, including those for failed requests, are exported in full for accurate diagnostics.
  • Fixed detection of Edge Infrastructure Services-pushed VLAN and bond configuration changes. EVE-OS now correctly detects and applies changes to VLAN and bond port configuration pushed from Edge Infrastructure Services, including VLAN ID, bond mode, bond monitoring settings, and aggregated port membership.
  • Fixed bond membership reconfiguration leaving broken network state. Fixed a bug where swapping physical interfaces between two bonds could leave the device with a broken network configuration and a 'port aggregated by multiple bonds' error requiring a reboot; bond membership changes are now applied cleanly without disrupting connectivity.
  • SR-IOV VF configuration message-size fix. Fixed a panic that could occur when many SR-IOV Virtual Functions are configured, where the device-adapter configuration could exceed the 64 KB internal message-size limit. Empty fields are now omitted from serialization to stay within the limit.
  • Port-forwarded traffic fix after app redeployment. Fixed black-holed port-forwarded traffic after redeploying an application: EVE-OS now restarts dnsmasq when an app is removed so its stale DHCP lease is evicted, allowing the reused IP address to be correctly reassigned to the new instance.
  • SR-IOV virtual function detection reliability improvement. Improved SR-IOV Virtual Function detection reliability by polling for the VF directly instead of asynchronously, avoiding intermittent timeouts when bringing up VF-backed interfaces.
  • Intel PCH thermal device driver disabled. The Intel PCH thermal device driver is disabled to avoid passthrough issues with USB controllers on some devices.
  • Intel Wi-Fi 6 AX210 WLAN interface fix. Fixed an issue where edge devices equipped with the Intel Wi-Fi 6 AX210 adapter failed to create a WLAN interface.
  • Improved eSIM detection for devices with unspecified SIM type. EVE-OS now queries the EID (eUICC Identifier) to reliably identify eSIM slots when ModemManager reports the SIM type as unspecified, preventing devices from becoming stuck on an unsupported eSIM slot and ensuring automatic fallback to a physical SIM.
  • TLS root certificate tamper protection. Fixed a security issue where TLS root certificates could be tampered with via physical disk access. Certificates are now loaded directly from the integrity-protected /config partition.
  • Datastore API keys redacted in EdgeView output. Datastore API keys are no longer logged in plain text; EdgeView now redacts these values in diagnostic output to protect sensitive credentials.
  • Vault unseal fix for TPMs without SHA256 PCR bank. Fixed a vault unseal failure on devices whose TPM does not have the SHA256 PCR bank enabled, for example a TPM initialized with only the SHA1 bank, allowing the disk-encryption key to unseal correctly on these TPM configurations.

Known Issues

  • Single User installer might not work for ARM64 images.
  • Collect info from Edge Sync for edge nodes doesn’t work. 
Was this article helpful?
0 out of 0 found this helpful