You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
gce: fixes race condition in ServiceController, where nodes weren't updated in the node sync loop, by updating TargetPools in the ensureExternalLoadBalancer call. (#58368, @MrHohn)
fix race condition issue when detaching azure disk (#60183, @andyzhangx)
Get parent dir via canonical absolute path when trying to judge mount-point (#58433, @yue9944882)
Set node external IP for azure node when disabling UseInstanceMetadata (#60959, @feiskyer)
Fixes potential deadlock when deleting CustomResourceDefinition for custom resources with finalizers (#60542, @liggitt)
Unauthorized requests will not match audit policy rules where users or groups are set. (#59398, @CaoShuFeng)
[fluentd-gcp addon] Fixed bug with reporting metrics in event-exporter (#60126, @serathius)
Restores the ability of older clients to delete and scale jobs with initContainers (#59880, @liggitt)
fixed foreground deletion of podtemplates (#60683, @nilebox)
Bug fix: Clusters with GCE feature 'DiskAlphaAPI' enabled were unable to dynamically provision GCE PD volumes. (#59447, @verult)
Fix a regression that prevented using subPath volume mounts with secret, configMap, projected, and downwardAPI volumes (#61080, @liggitt)
Changes secret, configMap, downwardAPI and projected volumes to mount read-only, instead of allowing applications to write data and then reverting it automatically. Until version 1.11, setting the feature gate ReadOnlyAPIDataVolumes=false will preserve the old behavior. (#58720, @joelsmith)
Add automatic etcd 3.2->3.1 and 3.1->3.0 minor version rollback support to gcr.io/google_container/etcd images. For HA clusters, all members must be stopped before performing a rollback. (#59298, @jpbetz)
Fix the bug where kubelet in the standalone mode would wait for the update from the apiserver source. (#59276, @roboll)
fix the create azure file pvc failure if there is no storage account in current resource group (#56557, @andyzhangx)
Increase allowed lag for ssh key sync loop in tunneler to allow for one failure (#60068, @wojtek-t)
Fixing a bug in OpenStack cloud provider, where dual stack deployments (IPv4 and IPv6) did not work well when using kubenet as the network plugin. (#59749, @zioproto)
Bugfix: vSphere Cloud Provider (VCP) does not need any special service account anymore. (#59440, @rohitjogvmw)
Bug fix: webhooks now do not skip cluster-scoped resources (#58185, @caesarxuchao)
Action required: Before upgrading your Kubernetes clusters, double check if you had configured webhooks for cluster-scoped objects (e.g., nodes, persistentVolume), these webhooks will start to take effect. Delete/modify the configs if that's not desirable.
Other notable changes
CustomResourceDefinitions: OpenAPI v3 validation schemas containing $refreferences are no longer permitted (valid references could not be constructed previously because property ids were not permitted either). Before upgrading, ensure CRD definitions do not include those $ref fields. (#58438, @carlory)
Ensure IP is set for Azure internal load balancer. (#59083, @feiskyer)
Configurable etcd quota backend bytes in GCE (#59259, @wojtek-t)
cloudprovider/openstack: fix bug the tries to use octavia client to query flip (#59075, @jrperritt)
Fixed a bug which caused the apiserver reboot failure in the presence of malfunctioning webhooks. (#59073, @caesarxuchao)
Configurable etcd compaction frequency in GCE (#59106, @wojtek-t)
Prevent kubelet from getting wedged if initialization of modules returns an error. (#59020, @brendandburns)
[GCE] Apiserver uses InternalIP as the most preferred kubelet address type by default. (#59019, @MrHohn)
Expose Metrics Server metrics via /metric endpoint. (#57456, @kawych)
Get windows kernel version directly from registry (#58498, @feiskyer)
Fixes a bug where kubelet crashes trying to free memory under memory pressure (#58574, @yastij)
Updated priority of mirror pod according to PriorityClassName. (#58485, @k82cn)
Access to externally managed IP addresses via the kube-apiserver service proxy subresource is no longer allowed by default. This can be re-enabled via the ServiceProxyAllowExternalIPs feature gate, but will be disallowed completely in 1.11 (#57265, @brendandburns)
Add apiserver metric for number of requests dropped because of inflight limit. (#58340, @gmarek)
Add apiserver metric for current inflight-request usage. (#58342, @gmarek)
kube-apiserver is changed to use SSH tunnels for webhook iff the webhook is not directly routable from apiserver's network environment. (#58644, @yguo0905)
Fix a bug affecting nested data volumes such as secret, configmap, etc. (#57422, @joelsmith)
Reduce Metrics Server memory requirement (#58391, @kawych)
GCP: allow a master to not include a metadata concealment firewall rule (if it's not running the metadata proxy). (#58104, @ihmccreery)
Bump GCE metadata proxy to v0.1.9 to pick up security fixes. (#58221, @ihmccreery)
Fixes an issue where the resourceVersion of an object in a DELETE watch event was not the resourceVersion of the delete itself, but of the last update to the object. This could disrupt the ability of clients clients to re-establish watches properly. (#58547, @liggitt)
Fixed encryption key and encryption provider rotation (#58375, @liggitt)
Correctly handle transient connection reset errors on GET requests from client library. (#58520, @porridge)
Avoid controller-manager to crash when enabling IP alias for K8s cluster. (#58557, @jingax10)
Compare correct file names for volume detach operation (#57053, @prashima)
Fixed a garbage collection race condition where objects with ownerRefs pointing to cluster-scoped objects could be deleted incorrectly. (#57211, @liggitt)
Free up CPU and memory requested but unused by Metrics Server Pod Nanny. (#57252, @kawych)
Configurable liveness probe initial delays for etcd and kube-apiserver in GCE (#57749, @wojtek-t)
fix incorrect error info when creating an azure file PVC failed (#56550, @andyzhangx)
Retry 'connection refused' errors when setting up clusters on GCE. (#57394, @mborsz)
Fixes issue creating docker secrets with kubectl 1.9 for accessing docker private registries. (#57463, @dims)
Fixes a bug where if an error was returned that was not an autorest.DetailedError we would return "not found", nil which caused nodes to go to NotReady state. (#57484, @brendandburns)
Fix Heapster configuration and Metrics Server configuration to enable overriding default resource requirements. (#56965, @kawych)
Before updating to 1.9, you are strongly recommended to back up your etcd data. Consult the installation procedure you are using (kargo, kops, kube-up, kube-aws, kubeadm etc) for specific advice.
Some upgrade methods might upgrade etcd from 3.0 to 3.1 automatically when you upgrade from Kubernetes 1.8, unless you specify otherwise. Because etcd does not support downgrading, you'll need to either remain on etcd 3.1 or restore from a backup if you want to downgrade back to Kubernetes 1.8.
Introduction to 1.9.0
Kubernetes version 1.9 includes new features and enhancements, as well as fixes to identified issues. The release notes contain a brief overview of the important changes introduced in this release. The content is organized by Special Interest Group (SIG).
For initial installations, see the Setup topics in the Kubernetes documentation.
To upgrade to this release from a previous version, first take any actions required Before Upgrading.
For more information about this release and for the latest documentation, see the Kubernetes documentation.
Major themes
Kubernetes is developed by community members whose work is organized into
Special Interest Groups, which provide the themes that guide their work. For the 1.9 release, these themes included:
API Machinery
Extensibility. SIG API Machinery added a new class of admission control webhooks (mutating), and brought the admission control webhooks to beta.
Apps
The core workloads API, which is composed of the DaemonSet, Deployment, ReplicaSet, and StatefulSet kinds, has been promoted to GA stability in the apps/v1 group version. As such, the apps/v1beta2 group version is deprecated, and all new code should use the kinds in the apps/v1 group version.
Auth
SIG Auth focused on extension-related authorization improvements. Permissions can now be added to the built-in RBAC admin/edit/view roles using cluster role aggregation. Webhook authorizers can now deny requests and short-circuit checking subsequent authorizers. Performance and usability of the beta PodSecurityPolicy feature was also improved.
AWS
In v1.9 SIG AWS has improved stability of EBS support across the board. If a Volume is “stuck” in the attaching state to a node for too long a unschedulable taint will be applied to the node, so a Kubernetes admin can take manual steps to correct the error. Users are encouraged to ensure they are monitoring for the taint, and should consider automatically terminating instances in this state.
In addition, support for NVMe disks has been added to Kubernetes, and a service of type LoadBalancer can now be backed with an NLB instead of an ELB (alpha).
Azure
SIG Azure worked on improvements in the cloud provider, including significant work on the Azure Load Balancer implementation.
Cluster Lifecycle
SIG Cluster Lifecycle has been focusing on improving kubeadm in order to bring it to GA in a future release, as well as developing the Cluster API. For kubeadm, most new features, such as support for CoreDNS, IPv6 and Dynamic Kubelet Configuration, have gone in as alpha features. We expect to graduate these features to beta and beyond in the next release. The initial Cluster API spec and GCE sample implementation were developed from scratch during this cycle, and we look forward to stabilizing them into something production-grade during 2018.
Instrumentation
In v1.9 we focused on improving stability of the components owned by the SIG, including Heapster, Custom Metrics API adapters for Prometheus, and Stackdriver.
Network
In v1.9 SIG Network has implemented alpha support for IPv6, and alpha support for CoreDNS as a drop-in replacement for kube-dns. Additionally, SIG Network has begun the deprecation process for the extensions/v1beta1 NetworkPolicy API in favor of the networking.k8s.io/v1 equivalent.
Node
SIG Node iterated on the ability to support more workloads with better performance and improved reliability. Alpha features were improved around hardware accelerator support, device plugins enablement, and cpu pinning policies to enable us to graduate these features to beta in a future release. In addition, a number of reliability and performance enhancements were made across the node to help operators in production.
OpenStack
In this cycle, SIG OpenStack focused on configuration simplification through smarter defaults and the use of auto-detection wherever feasible (Block Storage API versions, Security Groups) as well as updating API support, including:
Block Storage (Cinder) V3 is now supported.
Load Balancer (Octavia) V2 is now supported, in addition to Neutron LBaaS V2.
Neutron LBaas V1 support has been removed.
This work enables Kubernetes to take full advantage of the relevant services as exposed by OpenStack clouds. Refer to the Cloud Providers documentation for more information.
Storage
SIG Storage is responsible for storage and volume plugin components.
For the 1.9 release, SIG Storage made Kubernetes more pluggable and modular by introducing an alpha implementation of the Container Storage Interface (CSI). CSI will make installing new volume plugins as easy as deploying a pod, and enable third-party storage providers to develop their plugins without the need to add code to the core Kubernetes codebase.
The SIG also focused on adding functionality to the Kubernetes volume subsystem, such as alpha support for exposing volumes as block devices inside containers, extending the alpha volume-resizing support to more volume plugins, and topology-aware volume scheduling.
Windows
We are advancing support for Windows Server and Windows Server Containers to beta along with continued feature and functional advancements on both the Kubernetes and Windows platforms. This opens the door for many Windows-specific applications and workloads to run on Kubernetes, significantly expanding the implementation scenarios and the enterprise reach of Kubernetes.
Before Upgrading
Consider the following changes, limitations, and guidelines before you upgrade:
API Machinery
The admission API, which is used when the API server calls admission control webhooks, is moved from admission.v1alpha1 to admission.v1beta1. You must delete any existing webhooks before you upgrade your cluster, and update them to use the latest API. This change is not backward compatible.
The admission webhook configurations API, part of the admissionregistration API, is now at v1beta1. Delete any existing webhook configurations before you upgrade, and update your configuration files to use the latest API. For this and the previous change, see also the documentation.
A new ValidatingAdmissionWebhook is added (replacing GenericAdmissionWebhook) and is available in the generic API server. You must update your API server configuration file to pass the webhook to the --admission-control flag. (#55988, @caesarxuchao) (#54513, @deads2k)
The deprecated options --portal-net and --service-node-ports for the API server are removed. (#52547, @xiangpengzhao)
Auth
PodSecurityPolicy: A compatibility issue with the allowPrivilegeEscalation field that caused policies to start denying pods they previously allowed was fixed. If you defined PodSecurityPolicy objects using a 1.8.0 client or server and set allowPrivilegeEscalation to false, these objects must be reapplied after you upgrade. (#53443, @liggitt)
KMS: Alpha integration with GCP KMS was removed in favor of a future out-of-process extension point. Discontinue use of the GCP KMS integration and ensure data has been decrypted (or reencrypted with a different provider) before upgrading (#54759, @sakshamsharma)
CLI
Swagger 1.2 validation is removed for kubectl. The options --use-openapi and --schema-cache-dir are also removed because they are no longer needed. (#53232, @apelisse)
Cluster Lifecycle
You must either specify the --discovery-token-ca-cert-hash flag to kubeadm join, or opt out of the CA pinning feature using --discovery-token-unsafe-skip-ca-verification.
The default auto-detect behavior of the kubelet's --cloud-provider flag is removed.
You can manually set --cloud-provider=auto-detect, but be aware that this behavior will be removed completely in a future version.
Best practice for version 1.9 and future versions is to explicitly set a cloud-provider. See the documentation
The kubeadm --skip-preflight-checks flag is now deprecated and will be removed in a future release.
If you are using the cloud provider API to determine the external host address of the apiserver, set --external-hostname explicitly instead. The cloud provider detection has been deprecated and will be removed in the future (#54516, @dims)
Multicluster
Development of Kubernetes Federation has moved to github.com/kubernetes/federation. This move out of tree also means that Federation will begin releasing separately from Kubernetes. Impact:
Federation-specific behavior will no longer be included in kubectl
kubefed will no longer be released as part of Kubernetes
The Federation servers will no longer be included in the hyperkube binary and image. (#53816, @marun)
Node
The kubelet --network-plugin-dir flag is removed. This flag was deprecated in version 1.7, and is replaced with --cni-bin-dir. (#53564, @supereagle)
kubelet's --cloud-provider flag no longer defaults to "auto-detect". If you want cloud-provider support in kubelet, you must set a specific cloud-provider explicitly. (#53573, @dims)
Network
NetworkPolicy objects are now stored in etcd in v1 format. After you upgrade to version 1.9, make sure that all NetworkPolicy objects are migrated to v1. (#51955, @danwinship)
The API group/version for the kube-proxy configuration has changed from componentconfig/v1alpha1 to kubeproxy.config.k8s.io/v1alpha1. If you are using a config file for kube-proxy instead of the command line flags, you must change its apiVersion to kubeproxy.config.k8s.io/v1alpha1. (#53645, @xiangpengzhao)
The "ServiceNodeExclusion" feature gate must now be enabled for the alpha.service-controller.kubernetes.io/exclude-balancer annotation on nodes to be honored. (#54644, @brendandburns)
Scheduling
Taint key unreachable is now in GA.
Taint key notReady is changed to not-ready, and is also now in GA.
These changes are automatically updated for taints. Tolerations for these taints must be updated manually. Specifically, you must:
Change node.alpha.kubernetes.io/notReady to node.kubernetes.io/not-ready
Change node.alpha.kubernetes.io/unreachable to node.kubernetes.io/unreachable
The node.kubernetes.io/memory-pressure taint now respects the configured whitelist. To use it, you must add it to the whitelist.(#55251, @deads2k)
The kube-scheduler command now supports a --config flag which is the location of a file containing a serialized scheduler configuration. Most other kube-scheduler flags are now deprecated. (#52562, @ironcladlou)
Opaque integer resources (OIR), which were (deprecated in v1.8.), have been removed. (#55103, @ConnorDoyle)
Storage
[alpha] The LocalPersistentVolumes alpha feature now also requires the VolumeScheduling alpha feature. This is a breaking change, and the following changes are required:
The VolumeScheduling feature gate must also be enabled on kube-scheduler and kube-controller-manager components.
The NoVolumeNodeConflict predicate has been removed. For non-default schedulers, update your scheduler policy.
The CheckVolumeBinding predicate must be enabled in non-default schedulers. (#55039, @msau42)
OpenStack
Remove the LbaasV1 of OpenStack cloud provider, currently only support LbaasV2. (#52717, @FengyunPan)
Known Issues
This section contains a list of known issues reported in Kubernetes 1.9 release. The content is populated from the [v1.9.x known issues and FAQ accumulator] #57159.
If you are adding Windows Server Virtual Machines as nodes to your Kubernetes environment, there is a compatibility issue with certain virtualization products. Specifically the Windows version of the kubelet.exe calls GetPhysicallyInstalledSystemMemory to get the physical memory installed on Windows machines and reports it as part of node metrics to heapster. This API call fails for VMware and VirtualBox virtualization environments. This issue is not present in bare metal Windows deployments, in Hyper-V, or on some of the popular public cloud providers.
If you run kubectl get po while the API server in unreachable, a misleading error is returned: the server doesn't have a resource type "po". To work around this issue, specify the full resource name in the command instead of the abbreviation: kubectl get pods. This issue will be fixed in a future release.
Mutating and validating webhook configurations are continuously polled by the API server (once per second). This issue will be fixed in a future release.
If a namespaced resource is owned by a cluster scoped resource, and the namespaced dependent is processed before the cluster scoped owner has ever been observed by the garbage collector, the dependent will be erroneously deleted.
This section provides an overview of deprecated API versions, options, flags, and arguments. Deprecated means that we intend to remove the capability from a future release. After removal, the capability will no longer work. The sections are organized by SIGs.
API Machinery
The kube-apiserver --etcd-quorum-read flag is deprecated and the ability to switch off quorum read will be removed in a future release. (#53795, @xiangpengzhao)
The /ui redirect in kube-apiserver is deprecated and will be removed in Kubernetes 1.10. (#53046, @maciaszczykm)
etcd2 as a backend is deprecated and support will be removed in Kubernetes 1.13 or 1.14.
Auth
Default controller-manager options for --cluster-signing-cert-file and --cluster-signing-key-file are deprecated and will be removed in a future release. (#54495, @mikedanese)
RBAC objects are now stored in etcd in v1 format. After upgrading to 1.9, ensure all RBAC objects (Roles, RoleBindings, ClusterRoles, ClusterRoleBindings) are at v1. v1alpha1 support is deprecated and will be removed in a future release. (#52950, @liggitt)
Cluster Lifecycle
kube-apiserver: --ssh-user and --ssh-keyfile are now deprecated and will be removed in a future release. Users of SSH tunnel functionality in Google Container Engine for the Master -> Cluster communication should plan alternate methods for bridging master and node networks. (#54433, @dims)
The kubeadm --skip-preflight-checks flag is now deprecated and will be removed in a future release.
If you are using the cloud provider API to determine the external host address of the apiserver, set --external-hostname explicitly instead. The cloud provider detection has been deprecated and will be removed in the future (#54516, @dims)
Network
The NetworkPolicy extensions/v1beta1 API is now deprecated and will be removed in a future release. This functionality has been migrated to a dedicated v1 API - networking.k8s.io/v1. v1beta1 Network Policies can be upgraded to the v1 API with the cluster/update-storage-objects.sh script. Documentation can be found here. (#56425, @cmluciano)
Storage
The volume.beta.kubernetes.io/storage-class annotation is deprecated. It will be removed in a future release. For the StorageClass API object, use v1, and in place of the annotation use v1.PersistentVolumeClaim.Spec.StorageClassName and v1.PersistentVolume.Spec.StorageClassName instead. (#53580, @xiangpengzhao)
Scheduling
The kube-scheduler command now supports a --config flag, which is the location of a file containing a serialized scheduler configuration. Most other kube-scheduler flags are now deprecated. (#52562, @ironcladlou)
Node
The kubelet's --enable-custom-metrics flag is now deprecated. (#54154, @mtaufen)
Notable Changes
Workloads API (apps/v1)
As announced with the release of version 1.8, the Kubernetes Workloads API is at v1 in version 1.9. This API consists of the DaemonSet, Deployment, ReplicaSet and StatefulSet kinds.
API Machinery
Admission Control
Admission webhooks are now in beta, and include the following:
Webhook admission now takes a config file that describes how to authenticate to webhook servers (#54414, @deads2k)
The dynamic admission webhook now supports a URL in addition to a service reference, to accommodate out-of-cluster webhooks. (#54889, @lavalamp)
Added namespaceSelector to externalAdmissionWebhook configuration to allow applying webhooks only to objects in the namespaces that have matching labels. (#54727, @caesarxuchao)
Metrics are added for monitoring admission plugins, including the new dynamic (webhook-based) ones. (#55183, @jpbetz)
The PodSecurityPolicy annotation kubernetes.io/psp on pods is set only once on create. (#55486, @sttts)
API & API server
Fixed a bug related to discovery information for scale subresources in the apps API group (#54683, @liggitt)
Fixed a bug that prevented client-go metrics from being registered in Prometheus. This bug affected multiple components. (#53434, @crassirostris)
Audit
Fixed a bug so that kube-apiserver now waits for open connections to finish before exiting. This fix provides graceful shutdown and ensures that the audit backend no longer drops events on shutdown. (#53695, @hzxuzhonghu)
Webhooks now always retry sending if a connection reset error is returned. (#53947, @crassirostris)
Custom Resources
Validation of resources defined by a Custom Resource Definition (CRD) is now in beta (#54647, @colemickens)
Custom resources served by CustomResourceDefinition objects now support field selectors for metadata.name and metadata.namespace. Also fixed an issue with watching a single object; earlier versions could watch only a collection, and so a watch on an instance would fail. (#53345, @ncdc)
Other
kube-apiserver now runs with the default value for service-cluster-ip-range (#52870, @jennybuckley)
Add --etcd-compaction-interval to apiserver for controlling request of compaction to etcd3 from apiserver. (#51765, @mitake)
The httpstream/spdy calls now support CIDR notation for NO_PROXY (#54413, @kad)
Code generation for CRD and User API server types is improved with the addition of two new scripts to k8s.io/code-generator: generate-groups.sh and generate-internal-groups.sh. (#52186, @sttts)
[beta] Flag --chunk-size={SIZE} is added to kubectl get to customize the number of results returned in large lists of resources. This reduces the perceived latency of managing large clusters because the server returns the first set of results to the client much more quickly. Pass 0 to disable this feature.(#53768, @smarterclayton)
[beta] API chunking via the limit and continue request parameters is promoted to beta in this release. Client libraries using the Informer or ListWatch types will automatically opt in to chunking. (#52949, @smarterclayton)
The --etcd-quorum-read flag now defaults to true to ensure correct operation with HA etcd clusters. This flag is deprecated and the flag will be removed in future versions, as well as the ability to turn off this functionality. (#53717, @liggitt)
Add events.k8s.io api group with v1beta1 API containing redesigned event type. (#49112, @gmarek)
Fixed a bug where API discovery failures were crashing the kube controller manager via the garbage collector. (#55259, @ironcladlou)
conversion-gen is now usable in a context without a vendored k8s.io/kubernetes. The Kubernetes core API is removed from default extra-peer-dirs. (#54394, @sttts)
Fixed a bug where the client-gen tag for code-generator required a newline between a comment block and a statement. tag shortcomings when newline is omitted (#53893) (#55233, @sttts)
The Apiserver proxy now rewrites the URL when a service returns an absolute path with the request's host. (#52556, @roycaihw)
Fixed server name verification of aggregated API servers and webhook admission endpoints (#56415, @liggitt)
Apps
The kubernetes.io/created-by annotation is no longer added to controller-created objects. Use the metadata.ownerReferences item with controller set to true to determine which controller, if any, owns an object. (#54445, @crimsonfaith91)
StatefulSet controller now creates a label for each Pod in a StatefulSet. The label is statefulset.kubernetes.io/pod-name, where pod-name = the name of the Pod. This allows users to create a Service per Pod to expose a connection to individual Pods. (#55329, @kow3ns)
DaemonSet status includes a new field named conditions, making it consistent with other workloads controllers. (#55272, @janetkuo)
StatefulSet status now supports conditions, making it consistent with other core controllers in v1 (#55268, @foxish)
The default garbage collection policy for Deployment, DaemonSet, StatefulSet, and ReplicaSet has changed from OrphanDependents to DeleteDependents when the deletion is requested through an apps/v1 endpoint. (#55148, @dixudx)
Clients using older endpoints will be unaffected. This change is only at the REST API level and is independent of the default behavior of particular clients (e.g. this does not affect the default for the kubectl --cascade flag).
If you upgrade your client-go libs and use the AppsV1() interface, please note that the default garbage collection behavior is changed.
Auth
Audit
RequestReceivedTimestamp and StageTimestamp are added to audit events (#52981, @CaoShuFeng)
Advanced audit policy now supports a policy wide omitStage (#54634, @CaoShuFeng)
RBAC
New permissions have been added to default RBAC roles (#52654, @liggitt):
The default admin and edit roles now include read/write permissions
The view role includes read permissions on poddisruptionbudget.policy resources.
RBAC rules can now match the same subresource on any resource using the form */(subresource). For example, */scale matches requests to replicationcontroller/scale. (#53722, @deads2k)
The RBAC bootstrapping policy now allows authenticated users to create selfsubjectrulesreviews. (#56095, @ericchiang)
RBAC ClusterRoles can now select other roles to aggregate. (#54005, @deads2k)
Fixed an issue with RBAC reconciliation that caused duplicated subjects in some bootstrapped RoleBinding objects on each restart of the API server. (#53239, @enj)
Other
Pod Security Policy can now manage access to specific FlexVolume drivers (#53179, @wanghaoran1988)
Audit policy files without apiVersion and kind are treated as invalid. (#54267, @ericchiang)
Fixed a bug that where forbidden errors were encountered when accessing ReplicaSet and DaemonSets objects via the apps API group. (#54309, @liggitt)
kube-apiserver: --oidc-username-prefix and --oidc-group-prefix flags are now correctly enabled. (#56175, @ericchiang)
If multiple PodSecurityPolicy objects allow a submitted pod, priority is given to policies that do not require default values for any fields in the pod spec. If default values are required, the first policy ordered by name that allows the pod is used. (#52849, @liggitt)
A new controller automatically cleans up Certificate Signing Requests that are Approved and Issued, or Denied. (#51840, @jcbsmpsn)
PodSecurityPolicies have been added for all in-tree cluster addons (#55509, @tallclair)
GCE
Added support for PodSecurityPolicy on GCE: ENABLE_POD_SECURITY_POLICY=true enables the admission controller, and installs policies for default addons. (#52367, @tallclair)
Autoscaling
HorizontalPodAutoscaler objects now properly functions on scalable resources in any API group. Fixed by adding a polymorphic scale client. (#53743, @DirectXMan12)
Fixed a set of minor issues with Cluster Autoscaler 1.0.1 (#54298, @mwielgus)
HPA tolerance is now configurable by setting the horizontal-pod-autoscaler-tolerance flag. (#52275, @mattjmcnaughton)
Fixed a bug that allowed the horizontal pod autoscaler to allocate more desiredReplica objects than maxReplica objects in certain instances. (#53690, @mattjmcnaughton)
AWS
Nodes can now use instance types (such as C5) that use NVMe. (#56607, @justinsb)
Nodes are now unreachable if volumes are stuck in the attaching state. Implemented by applying a taint to the node. (#55558, @gnufied)
Volumes are now checked for available state before attempting to attach or delete a volume in EBS. (#55008, @gnufied)
Fixed a bug where error log messages were breaking into two lines. (#49826, @dixudx)
Fixed a bug so that volumes are now detached from stopped nodes. (#55893, @gnufied)
You can now override the health check parameters for AWS ELBs by specifying annotations on the corresponding service. The new annotations are: healthy-threshold, unhealthy-threshold, timeout, interval. The prefix for all annotations is service.beta.kubernetes.io/aws-load-balancer-healthcheck-. (#56024, @dimpavloff)
Fixed a bug so that AWS ECR credentials are now supported in the China region. (#50108, @zzq889)
Fixed several issues with properly provisioning Azure disk storage (#55927, @andyzhangx)
A new service annotation service.beta.kubernetes.io/azure-dns-label-name now sets the Azure DNS label for a public IP address. (#47849, @tomerf)
Support for GetMountRefs function added; warning messages no longer displayed. (#54670, #52401, @andyzhangx)
Fixed an issue where an Azure PersistentVolume object would crash because the value of volumeSource.ReadOnly was set to nil. (#54607, @andyzhangx)
Fixed an issue with Azure disk mount failures on CoreOS and some other distros (#54334, @andyzhangx)
GRS, RAGRS storage account types are now supported for Azure disks. (#55931, @andyzhangx)
Azure NSG rules are now restricted so that external access is allowed only to the load balancer IP. (#54177, @itowlson)
Azure NSG rules can be consolidated to reduce the likelihood of hitting Azure resource limits (available only in regions where the Augmented Security Groups preview is available). (#55740, @itowlson)
Load balancer reconciliation now considers NSG rules based not only on Name, but also on Protocol, SourcePortRange, DestinationPortRange, SourceAddressPrefix, DestinationAddressPrefix, Access, and Direction. This change makes it possible to update NSG rules under more conditions. (#55752, @kevinkim9264)
Custom mountOptions for the azurefile StorageClass object are now respected. Specifically, dir_mode and file_mode can now be customized. (#54674, @andyzhangx)
Azure Load Balancer Auto Mode: Services can be annotated to allow auto selection of available load balancers and to provide specific availability sets that host the load balancers (for example, service.beta.kubernetes.io/azure-load-balancer-mode=auto|as1,as2...)
CLI
Kubectl
kubectl cp can now copy a remote file into a local directory. (#46762, @bruceauyeung)
kubectl cp now honors destination names for directories. A complete directory is now copied; in previous versions only the file contents were copied. (#51215, @juanvallejo)
You can now use kubectl get with a fieldSelector. (#50140, @dixudx)
Secret data containing Docker registry auth objects is now generated using the config.json format (#53916, @juanvallejo)
kubectl apply now calculates the diff between the current and new configurations based on the OpenAPI spec. If the OpenAPI spec is not available, it falls back to baked-in types. (#51321, @mengqiy)
kubectl explain now explains apiservices and customresourcedefinition. (Updated to use OpenAPI instead of Swagger 1.2.) (#53228, @apelisse)
kubectl get now uses OpenAPI schema extensions by default to select columns for custom types. (#53483, @apelisse)
kubectl top node now sorts by name and top pod sorts by namespace. Fixed a bug where results were inconsistently sorted. (#53560, @dixudx)
Fixed an issue where kubectl set commands occasionally encountered conversion errors for ReplicaSet and DaemonSet objects (#53158, @liggitt)
Cluster Lifecycle
API Server
[alpha] Added an --endpoint-reconciler-type command-line argument to select the endpoint reconciler to use. The default is to use the 'master-count' reconciler which is the default for 1.9 and in use prior to 1.9. The 'lease' reconciler stores endpoints within the storage api for better cleanup of deleted (or removed) API servers. The 'none' reconciler is a no-op reconciler, which can be used in self-hosted environments. (#51698, @rphillips)
Cloud Provider Integration
Added cloud-controller-manager to hyperkube. This is useful as a number of deployment tools run all of the kubernetes components from the hyperkube image/binary. It also makes testing easier as a single binary/image can be built and pushed quickly. (#54197, @colemickens)
Added the concurrent service sync flag to the Cloud Controller Manager to allow changing the number of workers. (--concurrent-service-syncs) (#55561, @jhorwit2)
kubelet's --cloud-provider flag no longer defaults to "auto-detect". If you want cloud-provider support in kubelet, you must set a specific cloud-provider explicitly. (#53573, @dims)
Kubeadm
kubeadm health checks can now be skipped with --ignore-preflight-errors; the --skip-preflight-checks flag is now deprecated and will be removed in a future release. (#56130, @anguslees) (#56072, @kad)
You now have the option to use CoreDNS instead of KubeDNS. To install CoreDNS instead of kube-dns, set CLUSTER_DNS_CORE_DNS to 'true'. This support is experimental. (#52501, @rajansandeep) (#55728, @rajansandeep)
Added --print-join-command flag for kubeadm token create. (#56185, @mattmoyer)
Added a new --etcd-upgrade keyword to kubeadm upgrade apply. When this keyword is specified, etcd's static pod gets upgraded to the etcd version officially recommended for a target kubernetes release. (#55010, @sbezverk)
Kubeadm now supports Kubelet Dynamic Configuration on an alpha level. (#55803, @xiangpengzhao)
Fixed iptables FORWARD policy for Docker 1.13 in kubernetes-worker charm (#54796, @Cynerva)
Upgrading the kubernetes-master units now results in staged upgrades just like the kubernetes-worker nodes. Use the upgrade action in order to continue the upgrade process on each unit such as juju run-action kubernetes-master/0 upgrade (#55990, @hyperbolic2346)
Added extra_sans config option to kubeapi-load-balancer charm. This allows the user to specify extra SAN entries on the certificate generated for the load balancer. (#54947, @hyperbolic2346)
Added extra-args configs to kubernetes-worker charm (#55334, @Cynerva)
Other
Base images have been bumped to Debian Stretch (9) (#52744, @rphillips)
Hyperkube can now run from a non-standard path. (#54570)
GCP
The service account made available on your nodes is now configurable. (#52868, @ihmccreery)
GCE nodes with NVIDIA GPUs attached now expose nvidia.com/gpu as a resource instead of alpha.kubernetes.io/nvidia-gpu. (#54826, @mindprince)
Docker's live-restore on COS/ubuntu can now be disabled (#55260, @yujuhong)
Metadata concealment is now controlled by the ENABLE_METADATA_CONCEALMENT env var. See cluster/gce/config-default.sh for more info. (#54150, @ihmccreery)
Masquerading rules are now added by default to GCE/GKE (#55178, @dnardo)
Fixed master startup issues with concurrent iptables invocations. (#55945, @x13n)
Fixed issue deleting internal load balancers when the firewall resource may not exist. (#53450, @nicksardo)
Instrumentation
Audit
Adjust batching audit webhook default parameters: increase queue size, batch size, and initial backoff. Add throttling to the batching audit webhook. Default rate limit is 10 QPS. (#53417, @crassirostris)
Bring all prom-to-sd container to the same image version (#54583)
Reduce log noise produced by prometheus-to-sd, by bumping it to version 0.2.2. (#54635, @loburm)
[fluentd-elasticsearch addon] Elasticsearch service name can be overridden via env variable ELASTICSEARCH_SERVICE_NAME (#54215, @mrahbar)
Multicluster
Federation
Kubefed init now supports --imagePullSecrets and --imagePullPolicy, making it possible to use private registries. (#50740, @dixudx)
Updated cluster printer to enable --show-labels (#53771, @dixudx)
Kubefed init now supports --nodeSelector, enabling you to determine on what node the controller will be installed. (#50749, @dixudx)
Network
IPv6
[alpha] IPv6 support has been added. Notable IPv6 support details include:
Support for IPv6-only Kubernetes cluster deployments. Note: This feature does not provide dual-stack support.
Support for IPv6 Kubernetes control and data planes.
Support for Kubernetes IPv6 cluster deployments using kubeadm.
Support for the iptables kube-proxy backend using ip6tables.
Relies on CNI 0.6.0 binaries for IPv6 pod networking.
Adds IPv6 support for kube-dns using SRV records.
Caveats
Only the CNI bridge and local-ipam plugins have been tested for the alpha release, although other CNI plugins do support IPv6.
HostPorts are not supported.
An IPv6 network mask for pod or cluster cidr network must be /66 or longer. For example: 2001:db1::/66, 2001:dead:beef::/76, 2001:cafe::/118 are supported. 2001:db1::/64 is not supported
Added iptables rules to allow Pod traffic even when default iptables policy is to reject. (#52569, @tmjd)
You can once again use 0 values for conntrack min, max, max per core, tcp close wait timeout, and tcp established timeout; this functionality was broken in 1.8. (#55261, @ncdc)
CoreDNS
You now have the option to use CoreDNS instead of KubeDNS. To install CoreDNS instead of kube-dns, set CLUSTER_DNS_CORE_DNS to 'true'. This support is experimental. (#52501, @rajansandeep) (#55728, @rajansandeep)
Other
Pod addresses will now be removed from the list of endpoints when the pod is in graceful termination. (#54828, @freehan)
You can now use a new supported service annotation for AWS clusters, service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy, which lets you specify which predefined AWS SSL policy you would like to use. (#54507, @micahhausler)
Termination grace period for the calico/node add-on DaemonSet has been eliminated, reducing downtime during a rolling upgrade or deletion. (#55015, @fasaxc)
Fixed bad conversion in host port chain name generating func which led to some unreachable host ports. (#55153, @chenchun)
The output for kubectl describe networkpolicy * has been enhanced to be more useful. (#46951, @aanm)
Kernel modules are now loaded automatically inside a kube-proxy pod (#52003, @vfreex)
Improve resilience by annotating kube-dns addon with podAntiAffinity to prefer scheduling on different nodes. (#52193, @StevenACoffman)
[alpha] Added DNSConfig field to PodSpec. "None" mode for DNSPolicy is now supported. (#55848, @MrHohn)
You can now add "options" to the host's /etc/resolv.conf (or --resolv-conf), and they will be copied into pod's resolv.conf when dnsPolicy is Default. Being able to customize options is important because it is common to leverage options to fine-tune the behavior of DNS client. (#54773, @phsiao)
Fixed a bug so that the service controller no longer retries if doNotRetry service update fails. (#54184, @MrHohn)
Added --no-negcache flag to kube-dns to prevent caching of NXDOMAIN responses. (#53604, @cblecker)
Node
Pod API
A single value in metadata.annotations/metadata.labels can now be passed into the containers via the Downward API. (#55902, @yguo0905)
Pods will no longer briefly transition to a "Pending" state during the deletion process. (#54593, @dashpole)
Added pod-level local ephemeral storage metric to the Summary API. Pod-level ephemeral storage reports the total filesystem usage for the containers and emptyDir volumes in the measured Pod. (#55447, @jingxu97)
Hardware Accelerators
Kubelet now exposes metrics for NVIDIA GPUs attached to the containers. (#55188, @mindprince)
The device plugin Alpha API no longer supports returning artifacts per device as part of AllocateResponse. (#53031, @vishh)
Fix to ignore extended resources that are not registered with kubelet during container resource allocation. (#53547, @jiayingz)
Container Runtime
[alpha] cri-tools: CLI and validation tools for CRI is now v1.0.0-alpha.0. This release mainly focuses on UX improvements. [@feiskyer]
Make crictl command more user friendly and add more subcommands.
Integrate with CRI verbose option to provide extra debug information.
Integration with cadvisor to provide better summary api support.
[stable] cri-o: CRI implementation for OCI-based runtimes is now v1.9. [@mrunalp]
Pass all the Kubernetes 1.9 end-to-end test suites and now gating PRs as well
Pass all the CRI validation tests
Release has been focused on bug fixes, stability and performance with runc and Clear Containers
Minikube integration
[stable] frakti: CRI implementation for hypervisor-based runtimes is now v1.9. [@resouer]
Added ARM64 release. Upgraded to CNI 0.6.0, added block device as Pod volume mode. Fixed CNI plugin compatibility.
Passed all CRI validation conformance tests and node end-to-end conformance tests.
[alpha] rktlet: CRI implementation for the rkt runtime is now v0.1.0. [@iaguis]
This is the first release of rktlet and it implements support for the CRI including fetching images, running pods, CNI networking, logging and exec.
This release passes 129/145 Kubernetes e2e conformance tests.
Container Runtime Interface API change. [@yujuhong]
A new field is added to CRI container log format to support splitting a long log line into multiple lines. (#55922, @Random-Liu)
CRI now supports debugging via a verbose option for status functions. (#53965, @Random-Liu)
Kubelet can now provide full summary api support for the CRI container runtime, with the exception of container log stats. (#55810, @abhi)
CRI now uses the correct localhost seccomp path when provided with input in the format of localhost//profileRoot/profileName. (#55450, @feiskyer)
Kubelet
The EvictionHard, EvictionSoft, EvictionSoftGracePeriod, EvictionMinimumReclaim, SystemReserved, and KubeReserved fields in the KubeletConfiguration object (kubeletconfig/v1alpha1) are now of type map[string]string, which facilitates writing JSON and YAML files. (#54823, @mtaufen)
Relative paths in the Kubelet's local config files (--init-config-dir) will now be resolved relative to the location of the containing files. (#55648, @mtaufen)
It is now possible to set multiple manifest URL headers with the kubelet's --manifest-url-header flag. Multiple headers for the same key will be added in the order provided. The ManifestURLHeader field in KubeletConfiguration object (kubeletconfig/v1alpha1) is now a map[string][]string, which facilitates writing JSON and YAML files. (#54643, @mtaufen)
The Kubelet's feature gates are now specified as a map when provided via a JSON or YAML KubeletConfiguration, rather than as a string of key-value pairs, making them less awkward for users. (#53025, @mtaufen)
Other
Fixed a performance issue (#51899) identified in large-scale clusters when deleting thousands of pods simultaneously across hundreds of nodes, by actively removing containers of deleted pods, rather than waiting for periodic garbage collection and batching resulting pod API deletion requests. (#53233, @dashpole)
Problems deleting local static pods have been resolved. (#48339, @dixudx)
CRI now only calls UpdateContainerResources when cpuset is set. (#53122, @resouer)
deviceplugin has been extended to more gracefully handle the full device plugin lifecycle, including: (#55088, @jiayingz)
Kubelet now uses an explicit cm.GetDevicePluginResourceCapacity() function that makes it possible to more accurately determine what resources are inactive and return a more accurate view of available resources.
Extends the device plugin checkpoint data to record registered resources so that we can finish resource removing devices even upon kubelet restarts.
Passes sourcesReady from kubelet to the device plugin to avoid removing inactive pods during the grace period of kubelet restart.
Extends the gpu_device_plugin e2e_node test to verify that scheduled pods can continue to run even after a device plugin deletion and kubelet restart.
The NodeController no longer supports kubelet 1.2. (#48996, @k82cn)
Kubelet now provides more specific events via FailedSync when unable to sync a pod. (#53857, @derekwaynecarr)
You can now disable AppArmor by setting the AppArmor profile to unconfined. (#52395, @dixudx)
ImageGCManage now consumes ImageFS stats from StatsProvider rather than cadvisor. (#53094, @yguo0905)
Hyperkube now supports the support --experimental-dockershim kubelet flag. (#54508, @ivan4th)
Kubelet no longer removes default labels from Node API objects on startup (#54073, @liggitt)
The overlay2 container disk metrics for Docker and CRI-O now work properly. (#54827, @dashpole)
Removed docker dependency during kubelet start up. (#54405, @resouer)
Added Windows support to the system verification check. (#53730, @bsteciuk)
Kubelet no longer removes unregistered extended resource capacities from node status; cluster admins will have to manually remove extended resources exposed via device plugins when they the remove plugins themselves. (#53353, @jiayingz)
The stats summary network value now takes into account multiple network interfaces, and not just eth0. (#52144, @andyxning)
Base images have been bumped to Debian Stretch (9). (#52744, @rphillips)
OpenStack Octavia v2 is now supported as a load balancer provider in addition to the existing support for the Neutron LBaaS V2 implementation. Neutron LBaaS V1 support has been removed. (#55393, @jamiehannaford)
OpenStack security group support has been beefed up (#50836, @FengyunPan):
Kubernetes will now automatically determine the security group for the node
Nodes can now belong to multiple security groups
Scheduling
Hardware Accelerators
Add ExtendedResourceToleration admission controller. This facilitates creation of dedicated nodes with extended resources. If operators want to create dedicated nodes with extended resources (such as GPUs, FPGAs, and so on), they are expected to taint the node with extended resource name as the key. This admission controller, if enabled, automatically adds tolerations for such taints to pods requesting extended resources, so users don't have to manually add these tolerations. (#55839, @mindprince)
Other
Scheduler cache ignores updates to an assumed pod if updates are limited to pod annotations. (#54008, @yguo0905)
Nominated pods are taken into account during scheduling to avoid starvation of higher priority pods. (#55933, @bsalamat)
Fixed 'Schedulercache is corrupted' error in kube-scheduler (#55262, @liggitt)
The kube-scheduler command now supports a --config flag which is the location of a file containing a serialized scheduler configuration. Most other kube-scheduler flags are now deprecated. (#52562, @ironcladlou)
A new scheduling queue helps schedule the highest priority pending pod first. (#55109, @bsalamat)
A Pod can now listen to the same port on multiple IP addresses. (#52421, @WIZARD-CXY)
Object count quotas supported on all standard resources using count/. syntax (#54320, @derekwaynecarr)
Apply algorithm in scheduler by feature gates. (#52723, @k82cn)
A new priority function ResourceLimitsPriorityMap (disabled by default and behind alpha feature gate and not part of the scheduler's default priority functions list) that assigns a lowest possible score of 1 to a node that satisfies one or both of input pod's cpu and memory limits, mainly to break ties between nodes with same scores. (#55906, @aveshagarwal)
Kubelet evictions now take pod priority into account (#53542, @dashpole)
PodTolerationRestriction admisson plugin: if namespace level tolerations are empty, now they override cluster level tolerations. (#54812, @aveshagarwal)
Storage
[stable] PersistentVolume and PersistentVolumeClaim objects must now have a capacity greater than zero.
[stable] Mutation of PersistentVolumeSource after creation is no longer allowed
[alpha] Deletion of PersistentVolumeClaim objects that are in use by a pod no longer permitted (if alpha feature is enabled).
[alpha] Container Storage Interface
New CSIVolumeSource enables Kubernetes to use external CSI drivers to provision, attach, and mount volumes.
[alpha] Raw block volumes
Support for surfacing volumes as raw block devices added to Kubernetes storage system.
Only Fibre Channel volume plugin supports exposes this functionality, in this release.
[alpha] Volume resizing
Added file system resizing for the following volume plugins: GCE PD, Ceph RBD, AWS EBS, OpenStack Cinder
[alpha] Topology Aware Volume Scheduling
Improved volume scheduling for Local PersistentVolumes, by allowing the scheduler to make PersistentVolume binding decisions while respecting the Pod's scheduling requirements.
Dynamic provisioning is not supported with this feature yet.
[alpha] Containerized mount utilities
Allow mount utilities, used to mount volumes, to run inside a container instead of on the host.
Bug Fixes
ScaleIO volume plugin is no longer dependent on the drv_cfg binary, so a Kubernetes cluster can easily run a containerized kubelet. (#54956, @vladimirvivien)
AWS EBS Volumes are detached from stopped AWS nodes. (#55893, @gnufied)
AWS EBS volumes are detached if attached to a different node than expected. (#55491, @gnufied)
PV Recycle now works in environments that use architectures other than x86. (#53958, @dixudx)
Pod Security Policy can now manage access to specific FlexVolume drivers.(#53179, @wanghaoran1988)
To prevent unauthorized access to CHAP Secrets, you can now set the secretNamespace storage class parameters for the following volume types:
ScaleIO; StoragePool and ProtectionDomain attributes no longer default to the value default. (#54013, @vladimirvivien)
Adds alpha support for volume scheduling, which allows the scheduler to make PersistentVolume binding decisions while respecting the Pod's scheduling requirements. Dynamic provisioning is not supported with this feature yet. (#55039, @msau42)
Action required for existing users of the LocalPersistentVolumes alpha feature:
The VolumeScheduling feature gate also has to be enabled on kube-scheduler and kube-controller-manager.
The NoVolumeNodeConflict predicate has been removed. For non-default schedulers, update your scheduler policy.
The CheckVolumeBinding predicate has to be enabled in non-default schedulers.
The admission/v1alpha1 API has graduated to v1beta1. Please delete your existing webhooks before upgrading the cluster, and update your admission webhooks to use the latest API, because the API has backwards incompatible changes.
The webhook registration related part of the admissionregistration API has graduated to v1beta1. Please delete your existing configurations before upgrading the cluster, and update your configuration file to use the latest API.
[action required] kubeadm join: Error out if CA pinning isn't used or opted out of (#55468, @yuexiao-wang)
* kubeadm now requires the user to specify either the --discovery-token-ca-cert-hash flag or the --discovery-token-unsafe-skip-ca-verification flag.
Other notable changes
A new priority function ResourceLimitsPriorityMap (disabled by default and behind alpha feature gate and not part of the scheduler's default priority functions list) that assigns a lowest possible score of 1 to a node that satisfies one or both of input pod's cpu and memory limits, mainly to break ties between nodes with same scores. (#55906, @aveshagarwal)
AWS: Fix detaching volume from stopped nodes. (#55893, @gnufied)
Fix stats summary network value when multiple network interfaces are available. (#52144, @andyxning)
Fix a typo in prometheus-to-sd configuration, that drops some stackdriver metrics. (#56473, @loburm)
Fixes server name verification of aggregated API servers and webhook admission endpoints (#56415, @liggitt)
Add PodDisruptionBudget support during pod preemption (#56178, @bsalamat)
Fix CRI localhost seccomp path in format localhost//profileRoot/profileName. (#55450, @feiskyer)
kubeadm: Add CoreDNS support for kubeadm "upgrade" and "alpha phases addons". (#55952, @rajansandeep)
The default garbage collection policy for Deployment, DaemonSet, StatefulSet, and ReplicaSet has changed from OrphanDependents to DeleteDependents when the deletion is requested through an apps/v1 endpoint. Clients using older endpoints will be unaffected. This change is only at the REST API level and is independent of the default behavior of particular clients (e.g. this does not affect the default for the kubectl --cascade flag). (#55148, @dixudx)
If you upgrade your client-go libs and use the AppsV1() interface, please note that the default garbage collection behavior is changed.
Expose single annotation/label via downward API (#55902, @yguo0905)
kubeadm: added --print-join-command flag for kubeadm token create. (#56185, @mattmoyer)
Implement kubelet side file system resizing. Also implement GCE PD resizing (#55815, @gnufied)
Improved PodSecurityPolicy admission latency, but validation errors are no longer limited to only errors from authorized policies. (#55643, @tallclair)
Add pod-level CPU and memory stats from pod cgroup information (#55969, @jingxu97)
kubectl apply use openapi to calculate diff be default. It will fall back to use baked-in types when openapi is not available. (#51321, @mengqiy)
It is now possible to override the healthcheck parameters for AWS ELBs via annotations on the corresponding service. The new annotations are healthy-threshold, unhealthy-threshold, timeout, interval (all prefixed with service.beta.kubernetes.io/aws-load-balancer-healthcheck-) (#56024, @dimpavloff)
Adding etcd version display to kubeadm upgrade plan subcommand (#56156, @sbezverk)
[fluentd-gcp addon] Fixes fluentd deployment on GCP when custom resources are set. (#55950, @crassirostris)
[fluentd-elasticsearch addon] Elasticsearch and Kibana are updated to version 5.6.4 (#55400, @mrahbar)
Block volumes Support: FC plugin update (#51493, @mtanino)
kube-apiserver: fixed --oidc-username-prefix and --oidc-group-prefix flags which previously weren't correctly enabled (#56175, @ericchiang)
New kubeadm flag --ignore-preflight-errors that enables to decrease severity of each individual error to warning. (#56072, @kad)
Old flag --skip-preflight-checks is marked as deprecated and acts as --ignore-preflight-errors=all
Block volumes Support: CRI, volumemanager and operationexecutor changes (#51494, @mtanino)
StatefulSet controller will create a label for each Pod in a StatefulSet. The label is named statefulset.kubernetes.io/pod-name and it is equal to the name of the Pod. This allows users to create a Service per Pod to expose a connection to individual Pods. (#55329, @kow3ns)
Add DNSConfig field to PodSpec and support "None" mode for DNSPolicy (Alpha). (#55848, @MrHohn)
Add pod-level local ephemeral storage metric in Summary API. Pod-level ephemeral storage reports the total filesystem usage for the containers and emptyDir volumes in the measured Pod. (#55447, @jingxu97)
Kubernetes update Azure nsg rules based on not just difference in Name, but also in Protocol, SourcePortRange, DestinationPortRange, SourceAddressPrefix, DestinationAddressPrefix, Access, and Direction. (#55752, @kevinkim9264)
Add support to take nominated pods into account during scheduling to avoid starvation of higher priority pods. (#55933, @bsalamat)
User should be able to create k8s cluster which spans across multiple ESXi clusters, datacenters or even vCenters.
vSphere cloud provider (VCP) uses OS hostname and not vSphere Inventory VM Name.
That means, now VCP can handle cases where user changes VM inventory name.
VCP can handle cases where VM migrates to other ESXi cluster or datacenter or vCenter.
The only requirement is the shared storage. VCP needs shared storage on all Node VMs.
The RBAC bootstrapping policy now allows authenticated users to create selfsubjectrulesreviews. (#56095, @ericchiang)
Defaulting of controller-manager options for --cluster-signing-cert-file and --cluster-signing-key-file is deprecated and will be removed in a later release. (#54495, @mikedanese)
Add ExtendedResourceToleration admission controller. This facilitates creation of dedicated nodes with extended resources. If operators want to create dedicated nodes with extended resources (like GPUs, FPGAs etc.), they are expected to taint the node with extended resource name as the key. This admission controller, if enabled, automatically adds tolerations for such taints to pods requesting extended resources, so users don't have to manually add these tolerations. (#55839, @mindprince)
Move unreachable taint key out of alpha. (#54208, @resouer)
Please note the existing pods with the alpha toleration should be updated by user himself to tolerate the GA taint.
add GRS, RAGRS storage account type support for azure disk (#55931, @andyzhangx)
Upgrading the kubernetes-master units now results in staged upgrades just like the kubernetes-worker nodes. Use the upgrade action in order to continue the upgrade process on each unit such as juju run-action kubernetes-master/0 upgrade (#55990, @hyperbolic2346)
Using ipset doing SNAT and packet filtering in IPVS kube-proxy (#54219, @m1093782566)
Add a new scheduling queue that helps schedule the highest priority pending pod first. (#55109, @bsalamat)
Adds to kubeadm upgrade apply, a new --etcd-upgrade keyword. When this keyword is specified, etcd's static pod gets upgraded to the etcd version officially recommended for a target kubernetes release. (#55010, @sbezverk)
Adding vishh as an reviewer/approver for hack directory (#54007, @vishh)
The GenericAdmissionWebhook is renamed as ValidatingAdmissionWebhook. Please update you apiserver configuration file to use the new name to pass to the apiserver's --admission-control flag. (#55988, @caesarxuchao)
iSCSI Persistent Volume Sources can now reference CHAP Secrets in namespaces other than the namespace of the bound Persistent Volume Claim (#51530, @rootfs)
Bugfix: master startup script on GCP no longer fails randomly due to concurrent iptables invocations. (#55945, @x13n)
admission/v1alpha1#AdmissionReview now contains AdmissionRequest and AdmissionResponse. AdmissionResponse includes a Patch field to allow mutating webhooks to send json patch to the apiserver.
Support AWS ECR credentials in China (#50108, @zzq889)
The EvictionHard, EvictionSoft, EvictionSoftGracePeriod, EvictionMinimumReclaim, SystemReserved, and KubeReserved fields in the KubeletConfiguration object (kubeletconfig/v1alpha1) are now of type map[string]string, which facilitates writing JSON and YAML files. (#54823, @mtaufen)
Fix code-generators to produce correct code when GroupName, PackageName and/or GoName differ. (#55614, @sttts)
Fixes bad conversion in host port chain name generating func which leads to some unreachable host ports. (#55153, @chenchun)
Relative paths in the Kubelet's local config files (--init-config-dir) will be resolved relative to the location of the containing files. (#55648, @mtaufen)
kubeadm: Fix a bug on some OSes where the kubelet tried to mount a volume path that is non-existent and on a read-only filesystem (#55320, @andrewrynhard)
add hostIP and protocol to the original hostport predicates procedure in scheduler. (#52421, @WIZARD-CXY)
action required: The storage.k8s.io/v1beta1 API and volume.beta.kubernetes.io/storage-class annotation are deprecated. They will be removed in a future release. Please use v1 API and field v1.PersistentVolumeClaim.Spec.StorageClassName/v1.PersistentVolume.Spec.StorageClassName instead. (#53580, @xiangpengzhao)
action required: Deprecated flags --portal-net and service-node-ports of kube-apiserver are removed. (#52547, @xiangpengzhao)
The node.kubernetes.io/memory-pressure taint now respects the configured whitelist. If you need to use it, you'll have to add it to the whitelist. (#55251, @deads2k)
Kubelet supports running mount utilities and final mount in a container instead running them on the host. (#53440, @jsafrane)
The PodSecurityPolicy annotation kubernetes.io/psp on pods is only set once on create. (#55486, @sttts)
The apiserver sends external versioned object to the admission webhooks now. Please update the webhooks to expect admissionReview.spec.object.raw to be serialized external versions of objects. (#55127, @caesarxuchao)
RBAC ClusterRoles can now select other roles to aggregate (#54005, @deads2k)
GCE nodes with NVIDIA GPUs attached now expose nvidia.com/gpu as a resource instead of alpha.kubernetes.io/nvidia-gpu. (#54826, @mindprince)
Remove docker dependency during kubelet start up (#54405, @resouer)
Fix session affinity issue with external load balancer traffic when ExternalTrafficPolicy=Local. (#55519, @MrHohn)
Add the concurrent service sync flag to the Cloud Controller Manager to allow changing the number of workers. (--concurrent-service-syncs) (#55561, @jhorwit2)
The dynamic admission webhook now supports a URL in addition to a service reference, to accommodate out-of-cluster webhooks. (#54889, @lavalamp)
Correct wording of kubeadm upgrade response for missing ConfigMap. (#53337, @jmhardison)
add create priorityclass sub command (#54858, @wackxu)
Added namespaceSelector to externalAdmissionWebhook configuration to allow applying webhooks only to objects in the namespaces that have matching labels. (#54727, @caesarxuchao)
[fluentd-elasticsearch addon] Elasticsearch service name can be overridden via env variable ELASTICSEARCH_SERVICE_NAME (#54215, @mrahbar)
Increase waiting time (120s) for docker startup in health-monitor.sh (#54099, @dchen1107)
not calculate new priority when user update other spec of a pod (#55221, @CaoShuFeng)
kubectl create pdb will no longer set the min-available field by default. (#53047, @yuexiao-wang)
StatefulSet status now has support for conditions, making it consistent with other core controllers in v1 (#55268, @foxish)
kubeadm: use the CRI for preflights checks (#55055, @runcom)
kubeadm now produces error during preflight checks if swap is enabled. Users, who can setup kubelet to run in unsupported environment with enabled swap, will be able to skip that preflight check. (#55399, @kad)
kubeadm will produce error if kubelet too new for control plane (#54868, @kad)
validate if default and defaultRequest match when creating LimitRange for GPU and hugepages. (#54919, @tianshapjq)
Add extra-args configs to kubernetes-worker charm (#55334, @Cynerva)
Restored kube-proxy's support for 0 values for conntrack min, max, max per core, tcp close wait timeout, and tcp established timeout. (#55261, @ncdc)
Audit policy files without apiVersion and kind are treated as invalid. (#54267, @ericchiang)
ReplicationController now shares its underlying controller implementation with ReplicaSet to reduce the maintenance burden going forward. However, they are still separate resources and there should be no externally visible effects from this change. (#49429, @enisoc)
Add limitrange/resourcequota/downward_api e2e tests for local ephemeral storage (#52523, @NickrenREN)
Support copying "options" in resolv.conf into pod sandbox when dnsPolicy is Default (#54773, @phsiao)
Fix support for configmap resource lock type in CCM (#55125, @jhorwit2)
Fixed 'Schedulercache is corrupted' error in kube-scheduler (#55262, @liggitt)
API discovery failures no longer crash the kube controller manager via the garbage collector. (#55259, @ironcladlou)
The kube-scheduler command now supports a --config flag which is the location of a file containing a serialized scheduler configuration. Most other kube-scheduler flags are now deprecated. (#52562, @ironcladlou)
add field selector for kubectl get (#50140, @dixudx)
Removes Priority Admission Controller from kubeadm since it's alpha. (#55237, @andrewsykim)
Add support for the webhook authorizer to make a Deny decision that short-circuits the union authorizer and immediately returns Deny. (#53273, @mikedanese)
kubeadm init: fix a bug that prevented the --token-ttl flag and tokenTTL configuration value from working as expected for infinite (0) values. (#54640, @mattmoyer)
Add CRI log parsing library at pkg/kubelet/apis/cri/logs (#55140, @feiskyer)
Add extra-args configs for scheduler and controller-manager to kubernetes-master charm (#55185, @Cynerva)
Add masquerading rules by default to GCE/GKE (#55178, @dnardo)
Disable the termination grace period for the calico/node add-on DaemonSet to reduce downtime during a rolling upgrade or deletion. (#55015, @fasaxc)
Google KMS integration was removed from in-tree in favor of a out-of-process extension point that will be used for all KMS providers. (#54759, @sakshamsharma)
kubeadm: reset: use crictl to reset containers (#54721, @runcom)
Check for available volume before attach/delete operation in EBS (#55008, @gnufied)
DaemonSet, Deployment, ReplicaSet, and StatefulSet have been promoted to GA and are available in the apps/v1 group version. (#53679, @kow3ns)
In conversion-gen removed Kubernetes core API from default extra-peer-dirs. (#54394, @sttts)
ScaleIO driver completely removes dependency on drv_cfg binary so a Kubernetes cluster can easily run a containerized kubelet. (#54956, @vladimirvivien)
Avoid unnecessary spam in kube-controller-manager log if --cluster-cidr is not specified and --allocate-node-cidrs is false. (#54934, @akosiaris)
It is now possible to set multiple manifest url headers via the Kubelet's --manifest-url-header flag. Multiple headers for the same key will be added in the order provided. The ManifestURLHeader field in KubeletConfiguration object (kubeletconfig/v1alpha1) is now a map[string][]string, which facilitates writing JSON and YAML files. (#54643, @mtaufen)
Add support for PodSecurityPolicy on GCE: ENABLE_POD_SECURITY_POLICY=true enables the admission controller, and installs policies for default addons. (#52367, @tallclair)
In PodTolerationRestriction admisson plugin, if namespace level tolerations are empty, now they override cluster level tolerations. (#54812, @aveshagarwal)
Fix handling of IPv6 URLs in NO_PROXY. (#53898, @kad)
Added extra_sans config option to kubeapi-load-balancer charm. This allows the user to specify extra SAN entries on the certificate generated for the load balancer. (#54947, @hyperbolic2346)
set leveled logging (v=4) for 'updating container' message (#54865, @phsiao)
Fix a bug where pod address is not removed from endpoints object while pod is in graceful termination. (#54828, @freehan)
kubeadm: Add support for adding a Windows node (#53553, @bsteciuk)
PodSecurityPolicy: Fixes a compatibility issue that caused policies that previously allowed privileged pods to start forbidding them, due to an incorrect default value for allowPrivilegeEscalation. PodSecurityPolicy objects defined using a 1.8.0 client or server that intended to set allowPrivilegeEscalation to false must be reapplied after upgrading to 1.8.1. (#53443, @liggitt)
RBAC objects are now stored in etcd in v1 format. After completing an upgrade to 1.9, RBAC objects (Roles, RoleBindings, ClusterRoles, ClusterRoleBindings) should be migrated to ensure all persisted objects are written in v1 format, prior to v1alpha1 support being removed in a future release. (#52950, @liggitt)
The kubernetes.io/created-by annotation is no longer added to controller-created objects. Use the metadata.ownerReferences item that has controller set to true to determine which controller, if any, owns an object. (#54445, @crimsonfaith91)
Fix overlay2 container disk metrics for Docker and CRI-O (#54827, @dashpole)
Fix iptables FORWARD policy for Docker 1.13 in kubernetes-worker charm (#54796, @Cynerva)
Fix kubeadm upgrade plan for offline operation: ignore errors when trying to fetch latest versions from dl.k8s.io (#54016, @praseodym)
Validate that PersistentVolumeSource is not changed during PV Update (#54761, @ianchakeres)
If you are using the cloud provider API to determine the external host address of the apiserver, set --external-hostname explicitly instead. The cloud provider detection has been deprecated and will be removed in the future (#54516, @dims)
Fixes discovery information for scale subresources in the apps API group (#54683, @liggitt)
Optimize Repeated registration of AlgorithmProvider when ApplyFeatureGates (#54047, @kuramal)
kubectl get will by default fetch large lists of resources in chunks of up to 500 items rather than requesting all resources up front from the server. This reduces the perceived latency of managing large clusters since the server returns the first set of results to the client much more quickly. A new flag --chunk-size=SIZE may be used to alter the number of items or disable this feature when 0 is passed. This is a beta feature. (#53768, @smarterclayton)
Add a new feature gate for enabling an alpha annotation which, if present, excludes the annotated node from being added to a service load balancers. (#54644, @brendandburns)
Implement graceful shutdown of the kube-apiserver by waiting for open connections to finish before exiting. Moreover, the audit backend will stop dropping events on shutdown. (#53695, @hzxuzhonghu)
fix warning messages due to GetMountRefs func not implemented in windows (#52401, @andyzhangx)
Object count quotas supported on all standard resources using count/<resource>.<group> syntax (#54320, @derekwaynecarr)
Add openssh-client back into the hyperkube image. This allows the gitRepo volume plugin to work properly. (#54250, @ixdy)
Bump version of all prometheus-to-sd images to v0.2.2. (#54635, @loburm)
[fluentd-gcp addon] Fluentd now runs in its own network, not in the host one. (#54395, @crassirostris)
fix azure storage account num exhausting issue (#54459, @andyzhangx)
Add Windows support to the system verification check (#53730, @bsteciuk)
Development of Kubernetes Federation has moved to github.com/kubernetes/federation. This move out of tree also means that Federation will begin releasing separately from Kubernetes. The impact of this is Federation-specific behavior will no longer be included in kubectl, kubefed will no longer be released as part of Kubernetes, and the Federation servers will no longer be included in the hyperkube binary and image. (#53816, @marun)
Metadata concealment on GCE is now controlled by the ENABLE_METADATA_CONCEALMENT env var. See cluster/gce/config-default.sh for more info. (#54150, @ihmccreery)
Fixed a bug which is causes kube-apiserver to not run without specifying service-cluster-ip-range (#52870, @jennybuckley)
the generic admission webhook is now available in the generic apiserver (#54513, @deads2k)
ScaleIO persistent volumes now support referencing a secret in a namespace other than the bound persistent volume claim's namespace; this is controlled during provisioning with the secretNamespace storage class parameter; StoragePool and ProtectionDomain attributes no longer defaults to the value default (#54013, @vladimirvivien)
fix azure pv crash due to volumeSource.ReadOnly value nil (#54607, @andyzhangx)
Fix an issue where pods were briefly transitioned to a "Pending" state during the deletion process. (#54593, @dashpole)
move getMaxVols function to predicates.go and add some NewVolumeCountPredicate funcs (#51783, @jiulongzaitian)
Remove the LbaasV1 of OpenStack cloud provider, currently only support LbaasV2. (#52717, @FengyunPan)
generic webhook admission now takes a config file which describes how to authenticate to webhook servers (#54414, @deads2k)
The NodeController will not support kubelet 1.2. (#48996, @k82cn)
fluentd-gcp runs with a dedicated fluentd-gcp service account (#54175, @tallclair)
Stop mounting the host certificates into fluentd's prometheus-to-sd container
fix azure disk mount failure on coreos and some other distros (#54334, @andyzhangx)
Allow GCE users to configure the service account made available on their nodes (#52868, @ihmccreery)
Load kernel modules automatically inside a kube-proxy pod (#52003, @vfreex)
kube-apiserver: --ssh-user and --ssh-keyfile are now deprecated and will be removed in a future release. Users of SSH tunnel functionality used in Google Container Engine for the Master -> Cluster communication should plan to transition to alternate methods for bridging master and node networks. (#54433, @dims)
Fix clustered datastore name to be absolute. (#54438, @pshahzeb)
Fix for service controller so that it won't retry on doNotRetry service update failure. (#54184, @MrHohn)
Add support for RBAC support to Kubernetes via Juju (#53820, @ktsakalozos)
RBD Persistent Volume Sources can now reference User's Secret in namespaces other than the namespace of the bound Persistent Volume Claim (#54302, @sbezverk)
Apiserver proxy rewrites URL when service returns absolute path with request's host. (#52556, @roycaihw)
Logging cleanups (#54443, @bowei)
* Updates kube-dns to use client-go 3
* Updates containers to use alpine as the base image on all platforms
* Adds support for IPv6
add --raw to kubectl create to POST using the normal transport (#54245, @deads2k)
Introduces a polymorphic scale client, allowing HorizontalPodAutoscalers to properly function on scalable resources in any API group. (#53743, @DirectXMan12)
Add PodDisruptionBudget to scheduler cache. (#53914, @bsalamat)
API machinery's httpstream/spdy calls now support CIDR notation for NO_PROXY (#54413, @kad)
Added option lb-provider to OpenStack cloud provider config (#54176, @gonzolino)
Allow for configuring etcd hostname in the manifest (#54403, @wojtek-t)
kubeadm will warn users if access to IP ranges for Pods or Services will be done via HTTP proxy. (#52792, @kad)
Resolves forbidden error when accessing replicasets and daemonsets via the apps API group (#54309, @liggitt)
admission webhook registrations without a specific failure policy default to failing closed. (#54162, @deads2k)
Device plugin Alpha API no longer supports returning artifacts per device as part of AllocateResponse. (#53031, @vishh)
admission webhook registration now allows URL paths (#54145, @deads2k)
The Kubelet's --enable-custom-metrics flag is now marked deprecated. (#54154, @mtaufen)
Use multi-arch busybox image for e2e (#54034, @dixudx)
sample-controller: add example CRD controller (#52753, @munnerz)
RBAC PolicyRules now allow resource=*/<subresource> to cover any-resource/<subresource>. For example, */scale covers replicationcontroller/scale. (#53722, @deads2k)
fix PV Recycle failed on non-amd64 platform (#53958, @dixudx)
Verbose option is added to each status function in CRI. Container runtime could return extra information in status response for debugging. (#53965, @Random-Liu)
Fixed log fallback termination messages when using docker with journald log driver (#52503, @joelsmith)
falls back to parse Docker runtime version as generic if not semver (#54040, @dixudx)
kubelet: prevent removal of default labels from Node API objects on startup (#54073, @liggitt)
Change scheduler to skip pod with updates only on pod annotations (#54008, @yguo0905)
PodSecurityPolicy: when multiple policies allow a submitted pod, priority is given to ones which do not require any fields in the pod spec to be defaulted. If the pod must be defaulted, the first policy (ordered by name) that allows the pod is used. (#52849, @liggitt)
Control HPA tolerance through the horizontal-pod-autoscaler-tolerance flag. (#52275, @mattjmcnaughton)
Add --no-negcache flag to kube-dns to prevent caching of NXDOMAIN responses. (#53604, @cblecker)
kubelet provides more specific events when unable to sync pod (#53857, @derekwaynecarr)
Kubelet evictions take pod priority into account (#53542, @dashpole)
Adds a new controller which automatically cleans up Certificate Signing Requests that are (#51840, @jcbsmpsn)
Approved and Issued, or Denied.
Optimize random string generator to avoid multiple locks & use bit-masking (#53720, @shyamjvs)
update cluster printer to enable --show-labels (#53771, @dixudx)
add RequestReceivedTimestamp and StageTimestamp to audit event (#52981, @CaoShuFeng)
Deprecation: The flag etcd-quorum-read of kube-apiserver is deprecated and the ability to switch off quorum read will be removed in a future release. (#53795, @xiangpengzhao)
Use separate client for leader election in scheduler to avoid starving leader election by regular scheduler operations. (#53793, @wojtek-t)
Support autoprobing node-security-group for openstack cloud provider, Support multiple Security Groups for cluster's nodes. (#50836, @FengyunPan)
fix a bug where disk pressure could trigger prematurely when using overlay2 (#53684, @dashpole)
kubeadm: Strip bootstrap tokens from the kubeadm-config ConfigMap (#53559, @fabriziopandini)
Skip podpreset test if the alpha feature settings/v1alpha1 is disabled (#53080, @jennybuckley)
Log when node is successfully initialized by Cloud Controller Manager (#53517, @andrewsykim)
apiserver: --etcd-quorum-read now defaults to true, to ensure correct operation with HA etcd clusters (#53717, @liggitt)
The Kubelet's feature gates are now specified as a map when provided via a JSON or YAML KubeletConfiguration, rather than as a string of key-value pairs. (#53025, @mtaufen)
Address a bug which allowed the horizontal pod autoscaler to allocate desiredReplicas > maxReplicas in certain instances. (#53690, @mattjmcnaughton)
Horizontal pod autoscaler uses REST clients through the kube-aggregator instead of the legacy client through the API server proxy. (#53205, @kawych)
Fix to prevent downward api change break on older versions (#53673, @timothysc)
API chunking via the limit and continue request parameters is promoted to beta in this release. Client libraries using the Informer or ListWatch types will automatically opt in to chunking. (#52949, @smarterclayton)
kubelet's --cloud-provider flag no longer defaults to "auto-detect". If you want cloud-provider support in kubelet, you must set a specific cloud-provider explicitly. (#53573, @dims)
Ignore extended resources that are not registered with kubelet during container resource allocation. (#53547, @jiayingz)
kubectl top pod and node should sort by namespace / name so that results don't jump around. (#53560, @dixudx)
Fix a bug that prevents client-go metrics from being registered in prometheus in multiple components. (#53434, @crassirostris)
Adjust batching audit webhook default parameters: increase queue size, batch size, and initial backoff. Add throttling to the batching audit webhook. Default rate limit is 10 QPS. (#53417, @crassirostris)
Added integration test for TaintNodeByCondition. (#53184, @k82cn)
Add API version apps/v1, and bump DaemonSet to apps/v1 (#53278, @janetkuo)
Change kubeadm create token to default to the group that almost everyone will want to use. The group is system:bootstrappers:kubeadm:default-node-token and is the group that kubeadm sets up, via an RBAC binding, for auto-approval (system:certificates.k8s.io:certificatesigningrequests:nodeclient). (#53512, @jbeda)
Using OpenStack service catalog to do version detection (#53115, @FengyunPan)
Fix metrics API group name in audit configuration (#53493, @piosz)
GCE: Fixes ILB sync on legacy networks and auto networks with unique subnet names (#53410, @nicksardo)
outputs <none> for columns specified by -o custom-columns but not found in object (#51750, @jianhuiz)
Metrics were added to network plugin to report latency of CNI operations (#53446, @sjenning)
GCE: Fix issue deleting internal load balancers when the firewall resource may not exist. (#53450, @nicksardo)
Custom resources served through CustomResourceDefinition now support field selectors for metadata.name and metadata.namespace. (#53345, @ncdc)
Add generate-groups.sh and generate-internal-groups.sh to k8s.io/code-generator to easily run generators against CRD or User API Server types. (#52186, @sttts)
kubelet --cert-dir now defaults to /var/lib/kubelet/pki, in order to ensure bootstrapped and rotated certificates persist beyond a reboot. resolves an issue in kubeadm with false-positive /var/lib/kubelet is not empty message during pre-flight checks (#53317, @liggitt)
Fix multi-attach error spam in logs and events (#53401, @gnufied)
Use not-ready to replace notReady in node condition taint keys. (#51266, @resouer)
Support completion for --clusterrole of kubectl create clusterrolebinding (#48267, @superbrothers)
Don't remove extended resource capacities that are not registered with kubelet from node status. (#53353, @jiayingz)
Kubectl: Remove swagger 1.2 validation. Also removes options --use-openapi and --schema-cache-dir as these are no longer needed. (#53232, @apelisse)
kubectl explain now uses openapi rather than swagger 1.2. (#53228, @apelisse)
Fixes a performance issue (#51899) identified in large-scale clusters when deleting thousands of pods simultaneously across hundreds of nodes, by actively removing containers of deleted pods, rather than waiting for periodic garbage collection and batching resulting pod API deletion requests. (#53233, @dashpole)
support nodeSelector in kubefed init (#50749, @dixudx)
Upgrade fluentd-elasticsearch addon to Elasticsearch/Kibana 5.6.2 (#53307, @aknuds1)
enable to specific unconfined AppArmor profile (#52395, @dixudx)
Update Influxdb image to latest version. (#53319, @kairen)
Update Grafana image to latest version.
Change influxdb-grafana-controller resource to Deployment.
Only do UpdateContainerResources when cpuset is set (#53122, @resouer)
Fixes an issue with RBAC reconciliation that could cause duplicated subjects in some bootstrapped rolebindings on each restart of the API server. (#53239, @enj)
Fix the bug that query Kubelet's stats summary with CRI stats enabled results in error. (#53107, @Random-Liu)
kubeadm allows the kubelets in the cluster to automatically renew their client certificates (#53252, @kad)
Fixes an issue with kubectl set commands encountering conversion errors for ReplicaSet and DaemonSet objects (#53158, @liggitt)
RBAC: The default admin and edit roles now include read/write permissions and the view role includes read permissions on poddisruptionbudget.policy resources. (#52654, @liggitt)
Change ImageGCManage to consume ImageFS stats from StatsProvider (#53094, @yguo0905)
BugFix: Exited containers are not Garbage Collected by the kubelet while the pod is running (#53167, @dashpole)
Improved generation of deb and rpm packages in bazel build (#53163, @kad)
Add a label which prevents a node from being added to a cloud load balancer (#53146, @brendandburns)
Fixes an issue pulling pod specs referencing unqualified images from docker.io on centos/fedora/rhel (#53161, @dims)
Remove the --docker-exec-handler flag. Only native exec handler is supported. (#52287, @yujuhong)
The Rackspace cloud provider has been removed after a long deprecation period. It was deprecated because it duplicates a lot of the OpenStack logic and can no longer be maintained. Please use the OpenStack cloud provider instead. (#52855, @NickrenREN)
Fixes an initializer bug where update requests which had an empty pending initializers list were erroneously rejected. (#52558, @jennybuckley)
BulkVerifyVolumes() implementation for vSphere (#52131, @BaluDontu)
Removing --prom-push-gateway flag from e2e tests (#52485, @nielsole)
If a container does not create a file at the terminationMessagePath, no message should be output about being unable to find the file. (#52567, @smarterclayton)
New GCE or GKE clusters created with cluster/kube-up.sh will not enable the legacy ABAC authorizer by default. If you would like to enable the legacy ABAC authorizer, export ENABLE_LEGACY_ABAC=true before running cluster/kube-up.sh. (#51367, @cjcullen)
The OwnerReferencesPermissionEnforcement admission plugin now requires update permission on the finalizers subresource of the referenced owner in order to set blockOwnerDeletion on an owner reference. (#49133, @deads2k)
The deprecated alpha and beta initContainer annotations are no longer supported. Init containers must be specified using the initContainers field in the pod spec. (#51816, @liggitt)
Action required: validation rule on metadata.initializers.pending[x].name is tightened. The initializer name needs to contain at least three segments separated by dots. If you create objects with pending initializers, (i.e., not relying on apiserver adding pending initializers according to initializerconfiguration), you need to update the initializer name in existing objects and in configuration files to comply to the new validation rule. (#51283, @caesarxuchao)
Audit policy supports matching subresources and resource names, but the top level resource no longer matches the subresouce. For example "pods" no longer matches requests to the logs subresource of pods. Use "pods/logs" to match subresources. (#48836, @ericchiang)
Protobuf serialization does not distinguish between [] and null. (#45294, @liggitt)
API fields previously capable of storing and returning either [] and null via JSON API requests (for example, the Endpoints subsets field) can now store only null when created using the protobuf content-type or stored in etcd using protobuf serialization (the default in 1.6+). JSON API clients should tolerate null values for such fields, and treat null and [] as equivalent in meaning unless specifically documented otherwise for a particular field.
Other notable changes
PersistentVolumeLabel admission controller is now deprecated. (#52618, @dims)
Mark the LBaaS v1 of OpenStack cloud provider deprecated. (#52821, @FengyunPan)
Mark image as deliberately optional in v1 Container struct. Many objects in the Kubernetes API inherit the container struct and only Pods require the field to be set. (#48406, @gyliu513)
[fluentd-gcp addon] Update Stackdriver plugin to version 0.6.7 (#52565, @crassirostris)
Adds ROTATE_CERTIFICATES environment variable to kube-up.sh script for GCE (#52115, @jcbsmpsn)
clusters. When that var is set to true, the command line flag enabling kubelet
client certificate rotation will be added to the kubelet command line.
Make sure that resources being updated are handled correctly by Quota system (#52452, @gnufied)
WATCHLIST calls are now reported as WATCH verbs in prometheus for the apiserver_request_* series. A new "scope" label is added to all apiserver_request_* values that is either 'cluster', 'resource', or 'namespace' depending on which level the query is performed at. (#52237, @smarterclayton)
Fixed the webhook admission plugin so that it works even if the apiserver and the nodes are in two networks (e.g., in GKE). (#50476, @caesarxuchao)
Fixed the webhook admission plugin so that webhook author could use the DNS name of the service as the CommonName when generating the server cert for the webhook.
Action required:
Anyone who generated server cert for admission webhooks need to regenerate the cert. Previously, when generating server cert for the admission webhook, the CN value doesn't matter. Now you must set it to the DNS name of the webhook service, i.e., <service.Name>.<service.Namespace>.svc.
Ignore pods marked for deletion that exceed their grace period in ResourceQuota (#46542, @derekwaynecarr)
custom resources that use unconventional pluralization now work properly with kubectl and garbage collection (#50012, @deads2k)
[fluentd-gcp addon] Fluentd will trim lines exceeding 100KB instead of dropping them. (#52289, @crassirostris)
dockershim: check the error when syncing the checkpoint. (#52125, @yujuhong)
By default, clusters on GCE no longer send RequestReceived audit event, if advanced audit is configured. (#52343, @crassirostris)
[BugFix] Soft Eviction timer works correctly (#52046, @dashpole)
Scheduler predicate developer should respect equivalence class cache (#52146, @resouer)
The kube-cloud-controller-manager flag --service-account-private-key-file was non-functional and is now deprecated. (#50289, @liggitt)
The kube-cloud-controller-manager flag --use-service-account-credentials is now honored consistently, regardless of whether --service-account-private-key-file was specified.
Fix credentials providers for docker sandbox image. (#51870, @feiskyer)
The ScaleIO volume plugin can now read the SDC GUID value as node label scaleio.sdcGuid; if binary drv_cfg is not installed, the plugin will still work properly; if node label not found, it defaults to drv_cfg if installed. (#50780, @vladimirvivien)
Log a warning when --audit-policy-file not passed to apiserver (#52071, @CaoShuFeng)
Fixes an issue with upgrade requests made via pod/service/node proxy subresources sending a non-absolute HTTP request-uri to backends (#52065, @liggitt)
v2 of the autoscaling API group, including improvements to the HorizontalPodAutoscaler, has moved from alpha1 to beta1. (#50708, @DirectXMan12)
Fixed a bug where some alpha features were enabled by default. (#51839, @jennybuckley)
Implement StatsProvider interface using CRI stats (#51557, @yguo0905)
set AdvancedAuditing feature gate to true by default (#51943, @CaoShuFeng)
Migrate the metrics/v1alpha1 API to metrics/v1beta1. The HorizontalPodAutoscaler (#51653, @DirectXMan12)
controller REST client now uses that version. For v1beta1, the API is now known as
resource-metrics.metrics.k8s.io.
In GCE with COS, increase TasksMax for Docker service to raise cap on number of threads/processes used by containers. (#51986, @yujuhong)
Fixes an issue with APIService auto-registration affecting rolling HA apiserver restarts that add or remove API groups being served. (#51921, @liggitt)
Sharing a PID namespace between containers in a pod is disabled by default in 1.8. To enable for a node, use the --docker-disable-shared-pid=false kubelet flag. Note that PID namespace sharing requires docker >= 1.13.1. (#51634, @verb)
Build test targets for all server platforms (#51873, @luxas)
Allow DNS resolution of service name for COS using containerized mounter. It fixed the issue with DNS resolution of NFS and Gluster services. (#51645, @jingxu97)
Implement Controller for growing persistent volumes (#49727, @gnufied)
Kubernetes 1.8 supports docker version 1.11.x, 1.12.x and 1.13.x. And also supports overlay2. (#51845, @Random-Liu)
The Deployment, DaemonSet, and ReplicaSet kinds in the extensions/v1beta1 group version are now deprecated, as are the Deployment, StatefulSet, and ControllerRevision kinds in apps/v1beta1. As they will not be removed until after a GA version becomes available, you may continue to use these kinds in existing code. However, all new code should be developed against the apps/v1beta2 group version. (#51828, @kow3ns)
kubeadm: Detect kubelet readiness and error out if the kubelet is unhealthy (#51369, @luxas)
Adds a new alpha EventRateLimit admission control that is used to limit the number of event queries that are accepted by the API Server. (#50925, @staebler)
The OpenID Connect authenticator can now use a custom prefix, or omit the default prefix, for username and groups claims through the --oidc-username-prefix and --oidc-groups-prefix flags. For example, the authenticator can map a user with the username "jane" to "google:jane" by supplying the "google:" username prefix. (#50875, @ericchiang)
Implemented kubeadm upgrade plan for checking whether you can upgrade your cluster to a newer version (#48899, @luxas)
Implemented kubeadm upgrade apply for upgrading your cluster from one version to an other
Switch to audit.k8s.io/v1beta1 in audit. (#51719, @soltysh)
controllers backoff better in face of quota denial (#49142, @joelsmith)
The event table output under kubectl describe has been simplified to show only the most essential info. (#51748, @smarterclayton)
Use arm32v7|arm64v8 images instead of the deprecated armhf|aarch64 image organizations (#50602, @dixudx)
audit newest impersonated user info in the ResponseStarted, ResponseComplete audit stage (#48184, @CaoShuFeng)
Fixed bug in AWS provider to handle multiple IPs when using more than 1 network interface per ec2 instance. (#50112, @jlz27)
Add flag "--include-uninitialized" to kubectl annotate, apply, edit-last-applied, delete, describe, edit, get, label, set. "--include-uninitialized=true" makes kubectl commands apply to uninitialized objects, which by default are ignored if the names of the objects are not provided. "--all" also makes kubectl commands apply to uninitialized objects. Please see the initializer doc for more details. (#50497, @dixudx)
GCE: Service object now supports "Network Tiers" as an Alpha feature via annotations. (#51301, @yujuhong)
When using kube-up.sh on GCE, user could set env ENABLE_POD_PRIORITY=true to enable pod priority feature gate. (#51069, @MrHohn)
The names generated for ControllerRevision and ReplicaSet are consistent with the GenerateName functionality of the API Server and will not contain "bad words". (#51538, @kow3ns)
PersistentVolumeClaim metrics like "volume_stats_inodes" and "volume_stats_capacity_bytes" are now reported via kubelet prometheus (#51553, @wongma7)
When using IP aliases, use a secondary range rather than subnetwork to reserve cluster IPs. (#51690, @bowei)
IPAM controller unifies handling of node pod CIDR range allocation. (#51374, @bowei)
It is intended to supersede the logic that is currently in range_allocator
and cloud_cidr_allocator. (ALPHA FEATURE)
Note: for this change, the other allocators still exist and are the default.
It supports two modes:
CIDR range allocations done within the cluster that are then propagated out to the cloud provider.
Cloud provider managed IPAM that is then reflected into the cluster.
The Kubernetes API server now supports the ability to break large LIST calls into multiple smaller chunks. A client can specify a limit to the number of results to return, and if more results exist a token will be returned that allows the client to continue the previous list call repeatedly until all results are retrieved. The resulting list is identical to a list call that does not perform chunking thanks to capabilities provided by etcd3. This allows the server to use less memory and CPU responding with very large lists. This feature is gated as APIListChunking and is not enabled by default. The 1.9 release will begin using this by default from all informers. (#48921, @smarterclayton)
add reconcile command to kubectl auth (#51636, @deads2k)
Performs validation (when applying for example) against OpenAPI schema rather than Swagger 1.0. (#51364, @apelisse)
Make all e2e tests lookup image to use from a centralized place. In that centralized place, add support for multiple platforms. (#49457, @mkumatag)
kubelet has alpha support for mount propagation. It is disabled by default and it is there for testing only. This feature may be redesigned or even removed in a future release. (#46444, @jsafrane)
Add selfsubjectrulesreview API for allowing users to query which permissions they have in a given namespace. (#48051, @xilabao)
Kubelet re-binds /var/lib/kubelet directory with rshared mount propagation during startup if it is not shared yet. (#45724, @jsafrane)
Fixed an issue (#47800) where kubectl logs -f failed with unexpected stream type "". (#50381, @sczizzo)
GCE: Internal load balancer IPs are now reserved during service sync to prevent losing the address to another service. (#51055, @nicksardo)
Switch JSON marshal/unmarshal to json-iterator library. Performance should be close to previous with no generated code. (#48287, @thockin)
Adds optional group and version information to the discovery interface, so that if an endpoint uses non-default values, the proper value of "kind" can be determined. Scale is a common example. (#49971, @deads2k)
#43077 introduced a condition where DaemonSet controller did not respect the TerminationGracePeriodSeconds of the Pods it created. This is now corrected. (#51279, @kow3ns)
Tainted nodes by conditions as following: (#49257, @k82cn)
* 'node.kubernetes.io/network-unavailable=:NoSchedule' if NetworkUnavailable is true
* 'node.kubernetes.io/disk-pressure=:NoSchedule' if DiskPressure is true
* 'node.kubernetes.io/memory-pressure=:NoSchedule' if MemoryPressure is true
* 'node.kubernetes.io/out-of-disk=:NoSchedule' if OutOfDisk is true
rbd: default image format to v2 instead of deprecated v1 (#51574, @dillaman)
Surface reasonable error when client detects connection closed. (#51381, @mengqiy)
Allow PSP's to specify a whitelist of allowed paths for host volume (#50212, @jhorwit2)
For Deployment, ReplicaSet, and DaemonSet, selectors are now immutable when updating via the new apps/v1beta2 API. For backward compatibility, selectors can still be changed when updating via apps/v1beta1 or extensions/v1beta1. (#50719, @crimsonfaith91)
Allows kubectl to use http caching mechanism for the OpenAPI schema. The cache directory can be configured through --cache-dir command line flag to kubectl. If set to empty string, caching will be disabled. (#50404, @apelisse)
Pod log attempts are now reported in apiserver prometheus metrics with verb CONNECT since they can run for very long periods of time. (#50123, @WIZARD-CXY)
The emptyDir.sizeLimit field is now correctly omitted from API requests and responses when unset. (#50163, @jingxu97)
Add local ephemeral storage support to LimitRange (#50757, @NickrenREN)
Add mount options field to StorageClass. The options listed there are automatically added to PVs provisioned using the class. (#51228, @wongma7)
Add 'kubectl set env' command for setting environment variables inside containers for resources embedding pod templates (#50998, @zjj2wry)
Implement IPVS-based in-cluster service load balancing (#46580, @dujun1990)
Release the kubelet client certificate rotation as beta. (#51045, @jcbsmpsn)
Adds --append-hash flag to kubectl create configmap/secret, which will append a short hash of the configmap/secret contents to the name during creation. (#49961, @mtaufen)
Add validation for CustomResources via JSON Schema. (#47263, @nikhita)
enqueue a sync task to wake up jobcontroller to check job ActiveDeadlineSeconds in time (#48454, @weiwei04)
Remove previous local ephemeral storage resource names: "ResourceStorageOverlay" and "ResourceStorageScratch" (#51425, @NickrenREN)
Add retainKeys to patchStrategy for v1 Volumes and extensions/v1beta1 DeploymentStrategy. (#50296, @mengqiy)
Add mount options field to PersistentVolume spec (#50919, @wongma7)
Use of the alpha initializers feature now requires enabling the Initializers feature gate. This feature gate is auto-enabled if the Initialzers admission plugin is enabled. (#51436, @liggitt)
kubectl zsh autocompletion will work with compinit (#50561, @cblecker)
[Experiment Only] When using kube-up.sh on GCE, user could set env KUBE_PROXY_DAEMONSET=true to run kube-proxy as a DaemonSet. kube-proxy is run as static pods by default. (#50705, @MrHohn)
Add --request-timeout to kube-apiserver to make global request timeout configurable. (#51415, @jpbetz)
Deprecate auto detecting cloud providers in kubelet. Auto detecting cloud providers go against the initiative for out-of-tree cloud providers as we'll now depend on cAdvisor integrations with cloud providers instead of the core repo. In the near future, --cloud-provider for kubelet will either be an empty string or external. (#51312, @andrewsykim)
Add error count and time-taken metrics for storage operations such as mount and attach, per-volume-plugin. (#50036, @wongma7)
A new predicates, named 'CheckNodeCondition', was added to replace node condition filter. 'NetworkUnavailable', 'OutOfDisk' and 'NotReady' maybe reported as a reason when failed to schedule pods. (#51117, @k82cn)
Add support for configurable groups for bootstrap token authentication. (#50933, @mattmoyer)
make volumesInUse sorted in node status updates (#49849, @dixudx)
Adds InstanceExists and InstanceExistsByProviderID to cloud provider interface for the cloud controller manager (#51087, @prydie)
Dynamic Flexvolume plugin discovery. Flexvolume plugins can now be discovered on the fly rather than only at system initialization time. (#50031, @verult)
Change eviction manager to manage one single local ephemeral storage resource (#50889, @NickrenREN)
Cloud Controller Manager now sets Node.Spec.ProviderID (#50730, @andrewsykim)
Paramaterize session affinity timeout seconds in service API for Client IP based session affinity. (#49850, @m1093782566)
Changing scheduling part of the alpha feature 'LocalStorageCapacityIsolation' to manage one single local ephemeral storage resource (#50819, @NickrenREN)
cloudprovider.Zones should support external cloud providers (#50858, @andrewsykim)
Finalizers are now honored on custom resources, and on other resources even when garbage collection is disabled via the apiserver flag --enable-garbage-collector=false (#51148, @ironcladlou)
Renamed the API server flag --experimental-bootstrap-token-auth to --enable-bootstrap-token-auth. The old value is accepted with a warning in 1.8 and will be removed in 1.9. (#51198, @mattmoyer)
Azure file persistent volumes can use a new secretNamespace field to reference a secret in a different namespace than the one containing their bound persistent volume claim. The azure file persistent volume provisioner honors a corresponding secretNamespace storage class parameter to determine where to place secrets containing the storage account key. (#47660, @rootfs)