Use Docker 19.03.11 for Kubernetes 1.18+

[hakman]

Due to security advisory kubernetes/kubernetes#91507, Docker 19.03.11 was released.
We may want to add and set this version as the default in 1.17 and 1.16 also.

Refs:

• https://github.com/docker/docker-ce/releases/v19.03.11

[olemarkus]

/lgtm

[rifelpet]

Is there a k/k PR that matches this? I couldn't fine one.

just curious

[hakman]

@rifelpet k/k didn't upgrade docker, but they mentioned in the advisory that this is the only unaffected version.
They only reference the major.minor version and not the patch one.

The earliest reference to 19.03 is in the release notes for 1.17:
https://github.com/kubernetes/kubernetes/blame/1180f976c616dbab2833c2f16d00771e2d4095d3/CHANGELOG/CHANGELOG-1.17.md#L943

[rifelpet]

Ah thats right, I forgot k/k only deals with minor versions. Maybe Kops should consider doing something similar? Allow the dockerVersion field to only reference major.minor and under the hood it always uses the latest patch? Something to think about, perhaps for the v1beta1 apiVersion...

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hakman, rifelpet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rifelpet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rifelpet]

or the dockerVersion field supports both major.minor.patch and major.minor (in which case we always use the latest patch) and we somehow encourage users to use major.minor. That would avoid making it a breaking change.

[hakman]

We don't really break anything, we only set the default version and that should be backwards compatible at least with those with same major & minor.
We still provide the older versions, but the user has to set it manually if he doesn't want what we choose.

[rifelpet]

True. Maybe we add support for major.minor in the dockerVersion field and have kops always use the latest patch version in that case. Does create cluster populate the field? If it does we could have it only use major.minor too.

[hakman]

Create cluster does not populate the version by default. It is up to us to set the default.
I like the idea though of major and minor instead of patch for the future. This would help remove older patch versions that should not be used.