Skip to content
This repository has been archived by the owner on Sep 30, 2020. It is now read-only.

v0.13.0
Compare
Choose a tag to compare
@davidmccormick davidmccormick released this 19 Aug 10:16
· 178 commits to master since this release
v0.13.0
c8b8989
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

Kube-aws is a community project and I am happy to announce this release; many thanks to everyone that contributed features, fixed bugs, that helped us test this release and raised issues! 🎉 🙏
With the v0.13.0 release of kube-aws we have decided to better align our release numbers so it will deploy kubernetes v1.13 (if you need to deploy Kubernetes 1.12 it is possible using our v0.12.x branch and selecting your own kubernetesVersion)
This release brings a number of changes related to the security and the stability of our kubernetes clusters and new features.

Components

Kubernetes: 1.13.7
Etcd: 3.2.26

Important Upgrade Notes

  • kube-aws is a convenience tool and it can not replace the need for knowledge of both Kubernetes and AWS - should you experience issues deploying this release then please perform your own debugging before raising a support issue, or post a message in the kube-aws slack channel.
  • It is expected that you should be able to upgrade from existing kube-aws v0.12.x clusters to v0.13.0 release. If you are migrating existing clusters then we strongly encourage you to test the upgrade in your test environments first. You might find that enabling the upgradeHelper plugin might help you successfully migrate if you are experiencing issues.
  • If you use the Experimental Kiam feature you must regenerate your kiam credentials when upgrading to this release (you probably won't want to re-generate ALL of the certificates on an existing cluster though). We are now targeting Kiam release 3.2 which requires additional SANs on the server certificatekiam-server and localhost. Failure the update the certs will result in kiam-server and kiam-agents stuck in CrashLoopBackOff.
  • A number of Experimental Features are no longer available and will need to be removed from your cluster.yaml files.
    • TLSBootstrap - is now active by default.
    • PodPriority - is now active by default.
    • PodSecurityPolicy - is now active by default (see warning below)
    • NodeAuthorizer - is now active by default.
    • PersistentVolumeClaimResize - is now active by default.
    • DenyEscalatingExec - is deprecated and has been removed (please use PodSecurityPolicy)
  • Two new admission controllers EventRateLimit and ExtendedResourceToleration are now included and enabled by default.
  • If you do not have any existing PodSecurityPolicies in your cluster, kube-aws creates a permissive policy and binds it to all service accounts, authenticated users and nodes. Please create your own policies and then remove the permissive bindings by removing the ClusterRoleBinding kube-aws:permissive-psp-cluster-wide.
    Warning! If you do have any existing PodSecurityPolicies you must ensure that they cover/allow all the workloads/pods that you want to run in your cluster, because once upgraded, no pods without a policy are allowed in the cluster!
  • If you have any scripts which connect to the kube-apiserver on port 8080, the insecure port 8080 is no longer available and you will need to change them to use certificate based authentication via port 443.
  • This release removes the legacy experimental autoscaler feature. You must now use the updated autoscaler plugin for enabling and configuring this functionality (see cluster.yaml)
  • For users of their own plugins, where you define systemd units using contents: -> content: it is replaced by just content: (also you can now use templating and source functionality the same as you do with resources and manifests).

Other Core Changes

  • The kube-apiserver no longer listens on the insecure port localhost:8080. All kube-aws services and scripts now communicate via the secure port (443) and use the admin certificate to authenticate.
  • The kubelets have authentication switched on and employ Webhook authorization to protect their services. We have added a number of RBAC objects to ensure scripts (such as cfn-signal) still have unauthenticated access to a kubelets /healthz endpoint. A number of kubelet settings are now set via a configuration file /etc/kubernetes/config/kubelet.yaml rather than by command-line switches.
  • We have removed heapster and enabled metrics-server by default.
  • We have moved to using CoreDNS instead of KubeDNS (but you can still select to use KubeDNS if you wish)
  • install-kube-system has undergone a refactoring which improves performance and adds flexibility in removing deprecated services. The apply-kube-aws-plugins service has been rolled into the install-kube-system and no longer exists.
  • A number of internal cluster components have seen version upgrades: -
    • Calico/Typha v3.6.1
    • Flannel v0.11.0
    • Cluster AutoScaler v1.13.4
    • Cluster Proportional Autoscaler 1.5.0
    • CoreDNS 1.5.0
    • KubeDNS 1.15.2
    • Kiam 3.2
    • DNSMasqMetrics 1.15.2
    • Helm/Tiller v2.13.1
    • Metrics Server v0.3.2
    • Addon Resizer 2.1

Features

Improvements

Bug fixes

Documentation

Other changes

  • #1553: Fixing adding cf resources to etcd and networking stack - master(Thanks to @omar-nahhas)
Assets 4
Loading