kubernetes-retired/kube-aws v0.13.0-rc.2

on GitHub

This is a Beta release candidate and is NOT considered ready for deploying/upgrading ANY kubernetes clusters that you care about! Please do try out this version on your test clusters and help us to identify bugs! Please raise any bugs as issues on the project - thanks for your help!

With the v0.13.0 release of kube-aws we have decided to better align our release numbers with the release of kubernetes that they deploy, and so we have jumped over the kubernetes v1.12 release and our version 0.13.0 will deploy kubernetes v1.13 (presently v1.13.5). This release brings a number of changes related to the security and the stability of our kubernetes clusters and a number of other features.

Components

Kubernetes: 1.13.6
Etcd: 3.2.26

Important Upgrade Notes

• It is expected that you should be able to upgrade from existing kube-aws v0.12.x clusters to v0.13.0 release.
• If you use the Experimental Kiam feature you must regenerate your kiam credentials when upgrading to this release (you probably won't want to re-generate ALL of the certificates on an existing cluster though). We are now targeting Kiam release 3.2 which requires additional SANs on the server certificatekiam-server and localhost. Failure the update the certs will result in kiam-server and kiam-agents stuck in CrashLoopBackOff.
• A number of Experimental Features are no longer available and will need to be removed from your cluster.yaml files.
  • TLSBootstrap - is now active by default.
  • PodPriority - is now active by default.
  • PodSecurityPolicy - is now active by default (see warning below)
  • NodeAuthorizer - is now active by default.
  • PersistentVolumeClaimResize - is now active by default.
  • DenyEscalatingExec - is deprecated and has been removed (please use PodSecurityPolicy)
• The previously unavailable admission controllers EventRateLimit and ExtendedResourceToleration are now included and enabled by default.
• If you do not have any existing PodSecurityPolicies in your cluster, kube-aws creates a permissive policy and binds it to all service accounts, authenticated users and nodes. Please create your own policies and then remove the permissive bindings by removing the ClusterRoleBinding kube-aws:permissive-psp-cluster-wide.
  Warning! If you do not have any existing PodSecurityPolicies you must ensure that they cover/allow all the workloads/pods that you want to run in your cluster, because once upgraded, no pods without a policy are allowed in the cluster!
• If you have any scripts which connect to the kube-apiserver on port 8080 you will need to change them to use certificate based authentication via port 443.

Other Core Changes

• The kube-apiserver no longer listens on the insecure port localhost:8080. All kube-aws services and scripts now communicate via the secure port (443) and use the admin certificate to authenticate.
• The kubelets have authentication switched on and employ Webhook authorization to protect their services. We have added a number of RBAC objects to ensure scripts (such as cfn-signal) still have unauthenticated access to a kubelets /healthz endpoint. A number of kubelet settings are now set via a configuration file /etc/kubernetes/config/kubelet.yaml rather than by command-line switches.
• We have removed heapster and enabled metrics-server by default.
• We have moved to using CoreDNS instead of KubeDNS (but you can still select to use KubeDNS if you wish)
• install-kube-system has undergone a refactoring which improves performance and adds flexibility in removing deprecated services. The apply-kube-aws-plugins service has been rolled into the install-kube-system and no longer exists.
• A number of internal cluster components have seen version upgrades: -
  • Calico/Typha v3.6.1
  • Flannel v0.11.0
  • Cluster AutoScaler v1.13.4
  • Cluster Proportional Autoscaler 1.5.0
  • CoreDNS 1.5.0
  • KubeDNS 1.15.2
  • Kiam 3.2
  • DNSMasqMetrics 1.15.2
  • Helm/Tiller v2.13.1
  • Metrics Server v0.3.2
  • Addon Resizer 2.1

Changes since v0.13.0-rc.1

• #1596: NAT Gateway tagging #1063(Thanks to @vsamidurai)
• #1598: Issue when kube-aws manages/creates subnets(Thanks to @davidmccormick)
• #1599: Allow setting Kiam version <3.0(Thanks to @davidmccormick)
• #1605: Etcd Upgrade(Thanks to @davidmccormick)
• #1612: Tag instances with their etcd or kubernetes version(Thanks to @davidmccormick)