Kubernetes v1.22.0-beta.1 is live!

46 views
Skip to first unread message

Arnaud Meukam

unread,
Jul 8, 2021, 9:58:25 AM7/8/21
to kubernetes-announce, kubernetes-dev
Kubernetes Community,

Kubernetes v1.22.0-beta.1 has been built and pushed using Golang version 1.16.5.

The release notes have been updated in CHANGELOG-1.22.md, with a pointer to them on GitHub:

v1.22.0-beta.1

Downloads for v1.22.0-beta.1

Source Code

filename sha512 hash
kubernetes.tar.gz 87201338ac3506b65fc0473302b59cd9e37af600d6a99b2542498832200b41a5106654199edd69816a61b2b4008ec5302fbc2dcb56d84ecf0917dfbbc64ab40e
kubernetes-src.tar.gz 41e2fa601b7c4b2695ff081898a19261ce6c6381cc0d0547cd87378b210c7cdc60d66e75e7126a7b3c77ecc7574ff4ef9108814a6066e2dbd3b52d8693252c38

Client Binaries

filename sha512 hash
kubernetes-client-darwin-amd64.tar.gz 3782d576437ad78702caa2d7243d00a352245f01a72c3e8ebad690eb56ed4f9a215c40e99b0ef7b4e4afcf1c05d6f747798f697fe2b9e171168efa15c68c8b86
kubernetes-client-darwin-arm64.tar.gz 42dbe3f4ccf968754665a73444cee465c00caf1d13bfead15e037d309633da5caddee100a313bf6c7da50075b7909c42a1f9c9b4ed7bf6bc73456238c9d93178
kubernetes-client-linux-386.tar.gz 11a417180848ffed539733e8483eb152a53f71f2be1d2b8d98f584334feca5cd9dc2ba2bd6b519e463d0da6c460409f56dae0728923e370a9a0489943e332a79
kubernetes-client-linux-amd64.tar.gz 91b9c1e284a5de454518edd6cfd1eec6b6fc4b2b523f2f68a09f349cc951828cd7af85e36a52f46c6cc7f3f418da10bbacc4bb0a8c7ca349231b76cf6d0a241e
kubernetes-client-linux-arm.tar.gz 101baed202c7e6b9e9fba5c6fb6e2b4b967717e6ea0a2440d7801490eff73e34cbee7f58afec2d270c07faf6bc499cba4472d15f41ca489940e3703a91cc681d
kubernetes-client-linux-arm64.tar.gz ea1adb89bb898cc57bd3d6641a7da3320609b56c7b16dc2631ae35e23d969c4d5c58ed14779fd2ef61238e08b0dfc4851662d69786284af02872a5b4bde19ca2
kubernetes-client-linux-ppc64le.tar.gz 7c2dfb68dcb5ca46c503d88f10ae0d68820fe2dcc47ba62c1a1ee676fd47ec1e6fdec773603e1155a8d04324a38e177440eda07c13f48d588e4f01d34070aa61
kubernetes-client-linux-s390x.tar.gz 8a6fa28269f734fd752c8f3560a476d93768df25c1aa39e235a443cd26fa4f37a177e5508f75ed143335cadbb589afe68eaedb1ea4d0edf3d122ac231eca9196
kubernetes-client-windows-386.tar.gz ae0029235bdf049349d66a38e095834fc14ad9c4d380f0befd798a6267d2a1dc1e6e36242c466053a05dc2e4c8684e9d2b6aa923c82d9d283c9f4e06a05cbd03
kubernetes-client-windows-amd64.tar.gz e197227390a93093426705d05091c85bbab5c705dc52073c5d087c0026bdf4ab882e314904b451987152c242b4accdc2c8092ca333c5b228161902039beef9a3

Server Binaries

filename sha512 hash
kubernetes-server-linux-amd64.tar.gz ccd594e9b0ca70ef90c01f5f0c6c34f7c0531bbdaaac54e8f61f12d3cfe8060f312d6865d60aad12a52aaad4674923d22ec8bb3c3dd692a88b42b0ae49801b7e
kubernetes-server-linux-arm.tar.gz 4378866e6190a0315c4e19645fe09e9de5f5c180f7201a1a5d733e106e7bf24dad2748a26a3c629b988b8928c7b92486f404f7981f53deb4c39150e95635a818
kubernetes-server-linux-arm64.tar.gz 977ce8965f3f55161652da41bfc51674dbd7f63d53ee3eaad69d92a448746d0f2eaf973af7189267275cdfb537018df2c54cd89ff4b46cc44cb964a5c7e7e4e3
kubernetes-server-linux-ppc64le.tar.gz 196276a28a4dc2e04b4a0a8fc3b369b69cc58bfecafd29b4d026f01b95b186ec1bb8ea5ab26e3b51f478d9689a42be76de42318d7cbc9cf199e7b4cda76f89be
kubernetes-server-linux-s390x.tar.gz ea2f0ebd438dfe3373bca05a1382945bbaa05ae3ec8474af1dcf641c82da8f3bfff5f309039243629ca485c699a46bc85b3f0f6fbd682bd340bc4869d3dc4c6d

Node Binaries

filename sha512 hash
kubernetes-node-linux-amd64.tar.gz 2f8238cab106e21f9e37c1423b2a04ff4e6e3947a7aeb786dc576af8d1fbff67a4719f79e79bb113abe47a42610c30ee3dde13322c6240b46d8ed641bf881de3
kubernetes-node-linux-arm.tar.gz fa9038d9fbdfca5e984c86697f78464121393086f5f4a478898656a81a5f37314a5e31a54026a04afa7af3eb62cb8fffe21a5f8f233fd8731aa1fa10c40a6ea9
kubernetes-node-linux-arm64.tar.gz 9d772b9e5cc59000c46fc3984c702ea569c27cfd4f1f7795eb4c1a79dac8a84cd834402faa282dbae9041c61443a2c3c677b9b6a2c8fe3d0a9f8df68cb34e7f0
kubernetes-node-linux-ppc64le.tar.gz 8213b88a902aaf9c6a90e80a3c7af492e5356ddf78edb2f9666090362e12a428b782b70ad6a7e0742873d6ac05e746b0a2a819be9b94ae443524963468054df7
kubernetes-node-linux-s390x.tar.gz f26af3bf8dc9499592cdaba971f087996ba8756237da7f1f5bed1e04ad87d90ca980ac325819222da7dadbf36bc6fa0c86bd227160c9b009be551ed6045b4eb3
kubernetes-node-windows-amd64.tar.gz 87fd57ba83810e17dd8b64da9e17161abf5c1ba92fa6dbe063de073506a0fb031cb175484a0fe4ea8be85796f7c10b2e288b6d736520eb5c15277046ec57617d

Changelog since v1.22.0-beta.0

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

  • The flag --experimental-patches is now deprecated and will be removed in a future release. You can migrate to using the new flag --patches. Add a new field {Init|Join}Configuration.patches.directory that can be used for the same purpose. For "init" and "join" it is now recommended that you migrate to configure patches via {Init|Join}Configuration.patches.directory. For the time being, these flags can be mixed with --config, but that might change in the future. On a command line, the last *patches flag takes precedence over previous flags and the value in config. "kubeadm upgrade" --patches will continue to be the only available option, since "upgrade" does not support a configuration file yet. (#103063, @neolit123) [SIG Cluster Lifecycle]

Changes by Kind

Deprecation

  • The feature Dynamic Kubelet Configuration is deprecated and kubelet will report warning when the flag --dynamic-config-dir is used. Feature gate DynamicKubeletConfig is disabled out of the box and needs to be explicitly enabled. (#102966, @SergeyKanzhelev) [SIG Cloud Provider, Instrumentation and Node]
  • The in-tree azure and gcp auth plugins have been deprecated. The https://github.com/Azure/kubelogin and gcloud commands serve as out-of-tree replacements via the kubectl/client-go credential plugin mechanism. (#102181, @enj) [SIG API Machinery and Auth]

API Change

  • A new score extension for NodeResourcesFit plugin that merges the functionality of NodeResourcesLeastAllocated,NodeResourcesMostAllocated,RequestedToCapacityRatio plugins, which are marked as deprecated as of v1beta2. In v1beta1, the three plugins can still be used in v1beta1 but not at the same time with the score extension of NodeResourcesFit 
    
#### Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

<!--
This section can be blank if this pull request does not require a release note.

When adding links which point to resources within git repositories, like
KEPs or supporting documentation, please reference a specific commit and avoid
linking directly to the master branch. This ensures that links reference a
specific point in time, rather than a document that may change over time.

See here for guidance on getting permanent links to files: https://help.github.com/en/articles/getting-permanent-links-to-files

Please use the following format for linking documentation:
- [KEP]: <link>
- [Usage]: <link>
- [Other doc]: <link>
--> ([#101822](https://github.com/kubernetes/kubernetes/pull/101822), [@yuzhiquan](https://github.com/yuzhiquan)) [SIG API Machinery, Apps, Auth, Cloud Provider, Instrumentation, Node, Scheduling, Storage and Testing]
  • Add DataSourceRef alpha field to PVC spec, which allows contents other than PVCs and VolumeSnapshots to be data sources. (#103276, @bswartz) [SIG API Machinery, Apps and Storage]
  • Add PersistentVolumeClaimDeletePoilcy to StatefulSet API. (#99378, @mattcary) [SIG API Machinery and Apps]
  • Add distributed tracing to the kube-apiserver. It is can be enabled with the feature gate: APIServerTracing=true (#94942, @dashpole) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Node, Storage and Testing]
  • Added new kubelet alpha feature SeccompDefault. This feature enables falling back to the RuntimeDefault (former runtime/default) seccomp profile if nothing else is specified in the pod/container SecurityContext or the pod annotation level. To use the feature, enable the feature gate as well as set the kubelet configuration option SeccompDefault (--seccomp-default) to true. (#101943, @saschagrunert) [SIG Node]
  • Adds the ReadWriteOncePod access mode for PersistentVolumes and PersistentVolumeClaims. Restricts volume access to a single pod on a single node. (#102028, @chrishenzie) [SIG Apps, CLI, Node, Scheduling and Storage]
  • Alpha swap support can now be enabled on Kubernetes nodes with the NodeSwapEnabled feature flag. See for details. (#102823, @ehashman) [SIG Node]
  • CSIServiceAccountToken is GA. (#103001, @zshihang) [SIG Auth and Storage]
  • Enforce the ReadWriteOncePod PVC access mode during scheduling (#103082, @chrishenzie) [SIG Apps, CLI, Node, Scheduling and Storage]
  • Improved parsing of label selectors (#102188, @alculquicondor) [SIG API Machinery]
  • Kube API server accepts Impersonate-Uid header to impersonate a user with a specific UID, in the same way that you can currently use Impersonate-User, Impersonate-Group and Impersonate-Extra (#99961, @margocrawf) [SIG API Machinery, Auth and Testing]
  • Kube-scheduler: a plugin enabled in a v1beta2 configuration file takes precedence over the default configuration for that plugin; this simplifies enabling default plugins with custom configuration without needing to explicitly disable those default plugins. (#99582, @chendave) [SIG Scheduling]
  • Scheduler could be configured to consider new resources beside CPU and memory, GPU for example, for the score plugin of NodeResourcesBalancedAllocation. (#101946, @chendave) [SIG Scheduling]
  • Suspend Job feature graduated to beta Added the "action" label to Job controller sync metrics job_sync_total and job_sync_duration_seconds (#102022, @adtac) [SIG Apps, Instrumentation and Testing]
  • TerminationGracePeriodSeconds on pod specs and container probes should not be negative. Negative values of TerminationGracePeriodSeconds will be treated as the value 1s on the delete path. Immutable field validation will be relaxed in order to update negative values. In a future release, negative values will not be permitted. (#98866, @wzshiming) [SIG API Machinery, Apps and Node]
  • The API documentation for the DaemonSet's spec.updateStrategy.rollingUpdate.maxUnavailable field was corrected to state that the value is rounded up. (#101296, @Miciah) [SIG Apps and CLI]
  • The CertificateSigningRequest.certificates.k8s.io API supports an optional expirationSeconds field to allow the client to request a particular duration for the issued certificate. The default signer implementations provided by the Kubernetes controller manager will honor this field as long as it does not exceed the --cluster-signing-duration flag. (#99494, @enj) [SIG API Machinery, Apps, Auth, CLI, Instrumentation, Node, Security and Testing]
  • The ServiceAppProtocol feature gate has been removed. It reached GA in Kubernetes 1.20. (#103190, @robscott) [SIG Network]

Feature

  • (alpha feature) If the CSI driver supports the NodeServiceCapability VOLUME_MOUNT_GROUP and the DelegateFSGroupToCSIDriver feature gate is enabled, kubelet will delegate applying FSGroup to the driver by passing it to NodeStageVolume and NodePublishVolume, regardless of what other FSGroup policies are set. (#103244, @verult) [SIG Apps and Storage]

  • API Server tracing can now trace re-entrant api requests. (#103218, @dashpole) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle and Instrumentation]

  • Add unified map on CRI to support cgroup v2. Refer to https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#unified. (#102578, @payall4u) [SIG Node]

  • Added field-selector option for kubectl top pod (#102155, @lauchokyip) [SIG CLI]

  • Added new metrics about API Priority and Fairness. Each one has a label priority_level. The last two also have a label bound taking values min and `max.

    • apiserver_flowcontrol_current_r: R(the time of the last change in state of the queues)
    • apiserver_flowcontrol_dispatch_r: R(the time of the latest request dispatch)
    • apiserver_flowcontrol_latest_s: S(the request last dispatched) = R(when that request starts executing in the virtual world)
    • apiserver_flowcontrol_next_s_bounds: min and max next S among non-empty queues
    • apiserver_flowcontrol_next_discounted_s_bounds: min and max next S - (sum [over requests executing] width * estimatedDuration) among non-empty queues (#102859, @MikeSpreitzer) [SIG API Machinery and Instrumentation]

  • Adding --restart-kubelet flag on E2E Node test suite (#97028, @knabben) [SIG Node and Testing]

  • Adds feature gate KubeletInUserNamespace which enables support for running kubelet in a user namespace.

    The user namespace has to be created before running kubelet. All the node components such as CRI need to be running in the same user namespace.

    When the feature gate is enabled, kubelet ignores errors that happens during setting the following sysctl values: vm.overcommit_memory, vm.panic_on_oom, kernel.panic, kernel.panic_on_oops, kernel.keys.root_maxkeys, kernel.keys.root_maxbytes. (These sysctl values for the host, not for the containers)

    kubelet also ignores an error during opening /dev/kmsg. This feature gate also allows kube-proxy to ignore an error during setting RLIMIT_NOFILE.

    This feature gate is especially useful for running Kubernetes inside Rootless Docker/Podman with kind or minikube. (#92863, @AkihiroSuda) [SIG Network, Node and Testing]

  • Adds metrics for the delegated authenticator used by extension APIs that delegate authentication logic to the Kube API server. (#99364, @p0lyn0mial) [SIG API Machinery, Auth, Instrumentation and Node]

  • Adds metrics for the delegated authorizer used by extension APIs that delegate authorization logic to the Kube API server. (#100339, @p0lyn0mial) [SIG API Machinery, Auth, Instrumentation and Node]

  • Client-go credential plugins are now GA (#102890, @ankeesler) [SIG API Machinery, Auth and Testing]

  • Deprecated warning message for igonre-errors flag. (#102677, @yuzhiquan) [SIG CLI]

  • Endpoints that have more than 1000 endpoints will be truncated and the endpoints.kubernetes.io/over-capacity annotation on the Endpoints resource will be set to truncated. (#103520, @swetharepakula) [SIG Apps and Network]

  • Expose /debug/flags/v to allow dynamically setting log level for kube-proxy. (#98306, @borgerli) [SIG Network]

  • Expose container start time as container_start_time_seconds in kubelet /metrics/resource endpoint (#102444, @sanwishe) [SIG Instrumentation, Node and Testing]

  • Extended resources defined in LeastAllocated, MostAllocated and RequestedToCapacityRatio plugin argument are bypassed by the scheduler if the incoming Pod doesn't request them in the pod spec. (#103169, @Huang-Wei) [SIG Scheduling]

  • Features gates EndpointSliceProxying & WindowsEndpointSliceProxying are now GA and cannot be disabled. Kube-proxy will use EndpointSlices for endpoint information. (#103451, @swetharepakula) [SIG Network]

  • IngressClassNamespacedParams feature gate has graduated to beta and is enabled by default. This means IngressClass resource will now have two new fields - spec.paramters.namespace and spec.parameters.scope. (#101711, @hbagdi) [SIG Network]

  • JSON logging format is no longer available by default in non-core Kubernetes Components and require owners to opt in. (#102869, @mengjiao-liu) [SIG API Machinery, Cluster Lifecycle and Instrumentation]

  • Kube-apiserver: the alpha PodSecurity feature can be enabled by passing --feature-gates=PodSecurity=true, and enables controlling allowed pods using namespace labels. See https://git.k8s.io/enhancements/keps/sig-auth/2579-psp-replacement for more details. (#103099, @liggitt) [SIG API Machinery, Auth, Instrumentation, Release, Security and Testing]

  • Kube-proxy uses V1 EndpointSlices. (#103306, @swetharepakula) [SIG Network]

  • LogarithmicScaleDown is now Beta and enabled by default (#101767, @damemi) [SIG Apps and Instrumentation]

  • Make kubectl command headers default for beta. (#103238, @seans3) [SIG CLI]

  • Mark net.ipv4.ip_unprivileged_port_start as safe sysctl (#103326, @pacoxu) [SIG Auth, Network, Node and Security]

  • Move the memory manager feature to the beta that will make it enabled by default with the None policy. (#101947, @cynepco3hahue) [SIG Node and Testing]

  • Promote the ServiceInternalTrafficPolicy feature to beta, which enables the internalTrafficPolicy field of Service by default. (#103462, @andrewsykim) [SIG Apps and Network]

  • Promote the feature ServiceLBNodePortControl to Beta (#100412, @hanlins) [SIG API Machinery, Apps, Architecture, Network and Testing]

  • Scheduler nows provides an option for plugin developers to move Pods to activeQ proactively. (#103383, @Huang-Wei) [SIG Scheduling and Testing]

  • Services with externalTrafficPolicy: Local now support graceful termination when using the iptables or ipvs mode of kube-proxy with EndpointSlices enabled. Specifically, if a connection for such a service arrives on a node when there are no "Ready" endpoints for the service, but there is at least one Terminating pod for that service on the node, then kube-proxy will send the traffic to the Terminating pod rather than dropping it. This patches up a race condition between when a pod is killed and when the external load balancer notices that it has been killed. (#97238, @andrewsykim) [SIG Network, Scalability and Windows]

  • Shell completion has been migrated to Cobra's go solution. kubectl is now smarter about disabling file completion when it does not apply. Furthermore, completion for the cp command does not show all files unless the user has started typing something. (#96087, @marckhouzam) [SIG CLI]

  • The HugePageStorageMediumSize feature has been promoted to GA, allowing unconditional usage of multiple sizes huge page resources on a container level. (#99144, @bart0sh) [SIG Apps, Node and Storage]

  • Update the system-validators library to v1.5.0. Includes validation for seccomp and fixes a stdout/stderr problem in the Docker validator. (#103390, @ironyman) [SIG Cluster Lifecycle]

  • Updates the following images to pick up CVE fixes:

    • debian to v1.8.0
    • debian-iptables to v1.6.5
    • setcap to v2.0.3 (#103235, @thejoycekung) [SIG API Machinery, Release and Testing]

  • kubectl debug is able to create ephemeral containers in pre-1.22 clusters with the EphemeralContainers feature enabled. Note that versions of kubectl prior to 1.22 are unable to create ephemeral containers in clusters version 1.22 and greater due to an API change. (#103292, @verb) [SIG CLI]

Documentation

  • kubectl debug will now print a warning message when using the --target option since many container runtimes do not support this yet. (#101074, @verb) [SIG CLI]

Bug or Regression

  • Cut strings at 100 chars or first new line in kubectl get (#103514, @soltysh) [SIG CLI]

  • Disruption controller shouldn't error while syncing for unmanaged pods. (#103414, @ravisantoshgudimetla) [SIG Apps and Testing]

  • Fix kubectl alpha debug node does not work on tainted(NoExecute) nodes and tolerate everything. (#98431, @wawa0210) [SIG CLI]

  • Fix performance regression for update and apply operations on large CRDs. (#103318, @jpbetz) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Storage]

  • Fixed SELinux relabeling of CSI volumes after CSI driver failure. (#103154, @jsafrane) [SIG Node and Storage]

  • Kubeadm: fix a bug where "kubeadm join" for control plane nodes would download certificates and keys from the cluster, but would not write publicly readable certificates and public keys with mode 0644 and instead use mode 0600. (#103313, @neolit123) [SIG Cluster Lifecycle]

  • Kubelet: the returned value for PodIPs is the same in the Downward API and in the pod.status.PodIPs field (#103307, @aojea) [SIG Network and Node]

  • Metrics Server will use Addon Manager 1.8.3 (#103541, @jbartosik) [SIG Cloud Provider and Instrumentation]

  • Pods that are known to the kubelet to have previously been Running should not revert to Pending state; the kubelet will now infer a termination. (#102821, @ehashman) [SIG Node]

  • Switch scheduler to generate the merge patch on pod status instead of the full pod (#103133, @marwanad) [SIG Scheduling]

  • The current behavior for Services that IPFamilyPolicy set as PreferDualstack. The current behavior when the cluster is upgraded to dual-stack is:

    • Services that have been set to IPFamilyPolicy = PreferDualstack will be upgraded when the service object is updated. e.g., when a user change a label.

    This behavior will change to:

    • Services that have been set IPFamilyPolicy = PreferDualstack will not be upgraded when the service object is updated. User can still change policy, type etc and existing behaviors remain the same. (#102898, @khenidak) [SIG Network and Testing]

  • Treat VSphere "File (vmdk path here) was not found" errors as success during volume deletion (#92372, @breunigs) [SIG Cloud Provider and Storage]

  • Upgrades functionality of kubectl kustomize as described at https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv4.2.0 (#103419, @natasha41575) [SIG CLI]

Other (Cleanup or Flake)

  • Featuregate ServiceLoadBalancerClass will be promoted to beta, this enables the Service loadBalancerClass field by default. (#103129, @XudongLiuHarold) [SIG Testing]
  • Increased CSINodeIDMaxLength from 128 bytes to 192 bytes. Prepare to increase the length limit to 256 bytes in 1.23 release. (#101256, @Jiawei0227) [SIG Storage]
  • Kubeadm: move the BootstrapToken* API and related utilities from v1beta3 to a separate API group/version - bootstraptoken/v1. (#102964, @neolit123) [SIG Cluster Lifecycle]
  • Remove balanced attached node volumes feature (#102443, @ravisantoshgudimetla) [SIG Scheduling]
  • Replace go-bindata with //go:embed (#99829, @palnabarun) [SIG Architecture, CLI, Node and Testing]
  • The deprecated RunAsGroup feature-gate has been removed, since the RunAsGroup feature graduated to GA in 1.21 and was unconditionally enabled. (#101581, @carlory) [SIG API Machinery and Node]
  • Update golang.org/x/net to v0.0.0-20210520170846-37e1c6afe023 (#103176, @CaoDonghui123) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Node and Storage]
  • Updated command descriptions and examples for grammar and punctuation consistency. (#103524, @bergerhoffer) [SIG Auth and CLI]

Dependencies

Added

Changed

Removed


Contributors, the CHANGELOG-1.22.md has been bootstrapped with v1.22.0-beta.1 release notes and you may edit now as needed.



Published by your Kubernetes Release Managers.

Reply all
Reply to author
Forward
This conversation is locked
You cannot reply and perform actions on locked conversations.
0 new messages