k8s v1.7.0 is live!

514 views
Skip to first unread message

K8s-Anago

unread,
Jun 30, 2017, 2:35:33 AM6/30/17
to cloud-kube...@google.com, kuberne...@googlegroups.com, kubernete...@googlegroups.com, xuc...@google.com
Kubernetes team,

Kubernetes v1.7.0 has been built and pushed.

The release notes have been updated in CHANGELOG.md with a pointer to it on github:

v1.7.0

Documentation & Examples

Downloads for v1.7.0

filename sha256 hash
kubernetes.tar.gz 947f1dd9a9b6b427faac84067a30c86e83e6391eb42f09ddcc50a8694765c31a/code>
kubernetes-src.tar.gz d3d8b0bfc31164dd703b38d8484cfed7981cacd1e496731880afa87f8bf39aac`/code>

Client Binaries

filename sha256 hash
kubernetes-client-darwin-386.tar.gz da298e24318e57ac8a558c390117bd7e9e596b3bdf1c5960979898fefe6c5c88
kubernetes-client-darwin-amd64.tar.gz c22f72e1592731155db5b05d0d660f1d7314288cb020f7980e2a109d9e7ba0e5
kubernetes-client-linux-386.tar.gz fc8e90e96360c3a2c8ec56903ab5acde1dffa4d641e1ee27b804ee6d8e824cf6
kubernetes-client-linux-amd64.tar.gz 8b3ed03f8a4b3a1ec124abde01632ee6dcec9daf9376f0288fd7500b5173981c
kubernetes-client-linux-arm64.tar.gz 8930c74dab9ada31e6994f0dc3fb22d41a602a2880b6b17112718ce73eac0574
kubernetes-client-linux-arm.tar.gz 20a6f4645cab3c0aef72f849ae90b2691605fd3f670ce36cc8aa11aef31c6edb
kubernetes-client-linux-ppc64le.tar.gz 509e214d55e8df1906894cbdc166e791761a3b82a52bcea0de65ceca3143c8b5
kubernetes-client-linux-s390x.tar.gz fd39f47b691fc608f2ea3fed35408dd4c0b1d198605ec17363b0987b123a4702
kubernetes-client-windows-386.tar.gz d9b72cfeefee0cd2db5f6a388bdb9da1e33514498f4d88be1b04282db5bfbd3d
kubernetes-client-windows-amd64.tar.gz c536952bd29a7ae12c8fa148d592cc3c353dea4d0079e8497edaf8a759a16006

Server Binaries

filename sha256 hash
kubernetes-server-linux-amd64.tar.gz 175fc9360d4f26b5f60b467798d851061f01d0ca555c254ef44a8a9822cf7560
kubernetes-server-linux-arm64.tar.gz f1e039e0e2923d1ea02fd76453aa51715ca83c5c26ca1a761ace2c717b79154f
kubernetes-server-linux-arm.tar.gz 48dc95e5230d7a44b64b379f9cf2e1ec72b7c4c7c62f4f3e92a73076ad6376db
kubernetes-server-linux-ppc64le.tar.gz dc079cd18333c201cfd0f5b0e93e602d020a9e665d8c13968170a2cd89eebeb4
kubernetes-server-linux-s390x.tar.gz fe6674e7d69aeffd522e543e957897e2cb943e82d5ccd368ccb9009e1128273f

Node Binaries

filename sha256 hash
kubernetes-node-linux-amd64.tar.gz 6c6cece62bad5bfeaf4a4b14e93c9ba99c96dc82b7855a2214cdf37a65251de8
kubernetes-node-linux-arm64.tar.gz dd75dc044fb1f337b60cb4b27c9bbdca4742d8bc0a1d03d13553a1b8fc593e98
kubernetes-node-linux-arm.tar.gz c5d832c93c24d77414a880d8b7c4fac9a7443305e8e5c704f637ff023ff56f94
kubernetes-node-linux-ppc64le.tar.gz 649813a257353c5b85605869e33aeeb0c070e64e6fee18bc9c6e70472aa05677
kubernetes-node-linux-s390x.tar.gz 5ca0a7e9e90b2de7aff7bbdc84f662140ce847ea46cdb78802ce75459e0cc043
kubernetes-node-windows-amd64.tar.gz 4b84b0025aff1d4406f3e5cd5fa86940f594e3ec6e1d12d3ce1eea5f5b3fc55d

Major Themes

Kubernetes 1.7 is a milestone release that adds security, stateful application, and extensibility features motivated by widespread production use of Kubernetes.

Security enhancements in this release include encrypted secrets (alpha), network policy for pod-to-pod communication, the node authorizer to limit Kubelet access to API resources, and Kubelet client / server TLS certificate rotation (alpha).

Major features for stateful applications include automated updates to StatefulSets, enhanced updates for DaemonSets, a burst mode for faster StatefulSets scaling, and (alpha) support for local storage.

Extensibility features include API aggregation (beta), CustomResourceDefinitions (beta) in favor of ThirdPartyResources, support for extensible admission controllers (alpha), pluggable cloud providers (alpha), and container runtime interface (CRI) enhancements.

Action Required Before Upgrading

Network

  • NetworkPolicy has been promoted from extensions/v1beta1 to the new networking.k8s.io/v1 API group. The structure remains unchanged from the v1beta1 API. The net.beta.kubernetes.io/network-policy annotation on Namespaces (used to opt in to isolation) has been removed. Instead, isolation is now determined on a per-pod basis. A NetworkPolicy may target a pod for isolation by including the pod in its spec.podSelector. Targeted Pods accept the traffic specified in the respective NetworkPolicy (and nothing else). Pods not targeted by any NetworkPolicy accept all traffic by default. ([#39164](https://github.com/kubernetes/kubernetes/pull/39164), [@danwinship](https://github.com/danwinship))

    Action Required: When upgrading to Kubernetes 1.7 (and a network plugin that supports the new NetworkPolicy v1 semantics), you should consider the following.

    The v1beta1 API used an annotation on Namespaces to activate the DefaultDeny policy for an entire Namespace. To activate default deny in the v1 API, you can create a NetworkPolicy that matches all Pods but does not allow any traffic:

    kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: default-deny
spec:
  podSelector:

    This will ensure that Pods that aren't matched by any other NetworkPolicy will continue to be fully-isolated, as they were in v1beta1.

    In Namespaces that previously did not have the "DefaultDeny" annotation, you should delete any existing NetworkPolicy objects. These had no effect in the v1beta1 API, but with v1 semantics they might cause some traffic to be unintentionally blocked.

Storage

API Machinery

Controller Manager

  • kube-controller-manager has dropped support for the --insecure-experimental-approve-all-kubelet-csrs-for-group flag. It is accepted in 1.7, but ignored. Instead, the csrapproving controller uses authorization checks to determine whether to approve certificate signing requests: ([#45619](https://github.com/kubernetes/kubernetes/pull/45619), [@mikedanese](https://github.com/mikedanese))

    • Before upgrading, users must ensure their controller manager will enable the csrapproving controller, create an RBAC ClusterRole and ClusterRoleBinding to approve CSRs for the same group, then upgrade. Example roles to enable the equivalent behavior can be found in the TLS bootstrapping documentation.

kubectl (CLI)

kubeadm

Cloud Providers

Known Issues

Populated via v1.7.x known issues / FAQ accumulator

  • The kube-apiserver discovery APIs (for example, /apis) return information about the API groups being served, and can change dynamically.
    During server startup, prior to the server reporting healthy (via /healthz), not all API groups may be reported.
    Wait for the server to report healthy (via /healthz) before depending on the information provided by the discovery APIs.
    Additionally, since the information returned from the discovery APIs may change dynamically, a cache of the results should not be considered authoritative.
    ETag support is planned in a future version to facilitate client caching.
    ([#47977](https://github.com/kubernetes/kubernetes/pull/47977), [#44957](https://github.com/kubernetes/kubernetes/pull/44957))

  • The DaemonSet controller will evict running Pods that do not tolerate the NoSchedule taint if the taint is added to a Node. There is an open PR ([#48189](https://github.com/kubernetes/kubernetes/pull/48189)) to resolve this issue, but as this issue also exists in 1.6, and as we do not wish to risk release stability by merging it directly prior to a release without sufficient testing, we have decided to defer merging the PR until the next point release for each minor version ([#48190](https://github.com/kubernetes/kubernetes/pull/48190)).

  • Protobuf serialization does not distinguish between [] and null.
    API fields previously capable of storing and returning either [] and null via JSON API requests (for example, the Endpoints subsets field)
    can now store only null when created using the protobuf content-type or stored in etcd using protobuf serialization (the default in 1.6).
    JSON API clients should tolerate null values for such fields, and treat null and [] as equivalent in meaning unless specifically documented otherwise for a particular field. ([#44593](https://github.com/kubernetes/kubernetes/pull/44593))

Deprecations

Cluster provisioning scripts

Client libraries

  • Swagger 1.2 spec (/swaggerapi/*) is deprecated. Please use OpenAPI instead.

DaemonSet

kube-proxy

Namespace

Scheduling

  • If you are using AffinityInAnnotations=true in --feature-gates, then the 1.7 release is your last opportunity to convert from specifying affinity/anti-affinity using the scheduler.alpha.kubernetes.io/affinity annotation on Pods, to using the Affinity field of PodSpec. Support for the alpha version of node and pod affinity (which uses the scheduler.alpha.kubernetes.io/affinity annotations on Pods) is going away in Kubernetes 1.8 (not this release, but the next release). If you have not enabled AffinityInAnnotations=true in --feature-gates, then this change does not affect you.

Notable Features

Features for this release were tracked via the use of the kubernetes/features issues repo. Each Feature issue is owned by a Special Interest Group from kubernetes/community

Kubefed

Kubernetes API

User Provided Extensions

Application Deployment

StatefulSet

  • [beta] StatefulSet supports RollingUpdate and OnDelete update strategies.

  • [alpha] StatefulSet authors should be able to relax the ordering and parallelism policies for software that can safely support rapid, out-of-order changes.

DaemonSet

Deployments

  • [beta] Deployments uses a hashing collision avoidance mechanism that ensures new rollouts will not block on hashing collisions anymore. (kubernetes/features#287)

PodDisruptionBudget

Security

Admission Control

TLS Bootstrapping

Audit Logging

  • [alpha] Advanced Auditing enhances the Kubernetes API audit logging capabilities through a customizable policy, pluggable audit backends, and richer audit data.

Encryption at Rest

Node Authorization

  • [beta] A new Node authorization mode and NodeRestriction admission plugin, when used in combination, limit nodes' access to specific APIs, so that they may only modify their own Node API object, only modify Pod objects bound to themselves, and only retrieve secrets and configmaps referenced by pods bound to themselves. See Using Node Authorization for more information.

Application Autoscaling

Horizontal Pod Autoscaler

Cluster Lifecycle

kubeadm

Cloud Provider Support

Cluster Federation

Placement Policy

  • [alpha] The federation-apiserver now supports a SchedulingPolicy admission controller that enables policy-based control over placement of federated resources. For more information, see Set up placement policies in Federation.

Cluster Selection

Instrumentation

Core Metrics API

  • [alpha] Introduces a lightweight monitoring component for serving the core resource metrics API used by the Horizontal Pod Autoscaler and other components (kubernetes/features#271)

Internationalization

kubectl (CLI)

Networking

Network Policy

Load Balancing

Node Components

Container Runtime Interface

Scheduling

Scheduler Extender

Storage

Local Storage

  • [alpha] This feature adds capacity isolation support for local storage at node, container, and volume levels. See updated Reserve Compute Resources for System Daemons documentation.

  • [alpha] Make locally attached (non-network attached) storage available as a persistent volume source. For more information, see Storage Volumes - local.

Volume Plugins

Metrics

Other notable changes

API Machinery

Admission plugin

API Machinery

Application autoscaling

Application Deployment

Cluster Autoscaling

Cloud Provider Enhancement

Cluster Provisioning

Cluster federation

Credential provider

Information for Kubernetes clients (openapi, swagger, client-go)

Instrumentation

Internal storage layer

Kubernetes Dashboard

kube-dns

kube-proxy

kube-scheduler

Storage

Networking

Node controller

Node Components

Scheduling

Security

Scalability

External Dependency Version Information

Continuous integration builds have used the following versions of external dependencies, however, this is not a strong recommendation and users should consult an appropriate installation or upgrade guide before deciding what versions of etcd, docker or rkt to use.

Previous Releases Included in v1.7.0


Leads, the CHANGELOG.md has been bootstrapped with v1.7.0 release notes and you may edit now as needed.


Published by anago, the Kubernetes Release Tool

Reply all
Reply to author
Forward
0 new messages