enterprise-2.16.1

The 2.16.1 stable point release includes bugfixes and minor improvements.

Supported Kubernetes versions

For this release, the minimum supported Kubernetes version remains 1.22, and the maximum supported Kubernetes version has been increased to 1.31.

2.16.0 users who use gRPC with retries should upgrade to this version. All other users may upgrade at their convenience or skip this release.

This is a stable point release designed to introduce minimal change. Please see the instructions in Upgrading BEL for how to upgrade.

To upgrade with BEL’s lifecycle automation operator, you will need Buoyant Extension version v0.32.1 or later.

Fix linkerd policy generate command to work on with BEL proxies that have custom image names.

Add support for configuring the timeout and failure thresholds for health probes of the multicluster gateway (linkerd2#13061)
Fix ability to set tolerations for the linkerd-autoregistration and linkerd-enterprise workloads
Docker images and Helm packages are now signed. Learn more.

Fix a bug in which the linkerd2-proxy may panic if a response was received before a request frame with the END_STREAM flag was sent (linkerd2-proxy#3216)

Update Go from 1.22.5 to 1.23.2 in controller, proxy, and proxy-init for both non-FIPS and FIPS to remediate CVE-2024-34155, CVE-2024-34156, and CVE-2024-34158
Update libssl3 in extension-init and policy-controller for FIPS, and in proxy for both non-FIPS and FIPS to remediate CVE-2024-2511, CVE-2024-4603, CVE-2024-4741, CVE-2024-5535, and CVE-2024-6119
Update openssl in extension-init and policy-controller for FIPS to remediate CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-1255, CVE-2023-2650, CVE-2023-2975, CVE-2023-3446, CVE-2023-3817, CVE-2023-4807, CVE-2023-5363, CVE-2023-5678, CVE-2023-6129, CVE-2023-6237, CVE-2024-0727, CVE-2024-2511, CVE-2024-4603, CVE-2024-5535, and CVE-2024-6119
Update libcrypto3 and libssl3 in proxy-init for both non-FIPS and FIPS to remediate CVE-2024-6119