Kubernetes supportability: external dependencies

[Jordan Liggitt]

TL;DR: If you are interested (or already involved) in reducing Kubernetes' external dependencies, or ensuring we can actually support our released versions as long as we want to, please review and contribute to this document: Kubernetes supportability: external dependencies

One of the follow-ups from the support / version skew discussion was to document what levels of Kubernetes dependencies are supported and tested. Additionally, a question that came up in WG-LTS recently was how our dependencies (like go, etcd, docker) impact our ability to support released kubernetes versions (for the currently claimed three releases, or if we wanted to lengthen support to four releases/1 year). The most recent examples:

• we adopted go1.12 aggressively to make sure kubernetes 1.14 was built with a version of go that would be supported for the 1.14 lifetime (#74632)
• trying to determine if kubernetes 1.11 (which still receives support/patch releases) was tested with version of docker that received security fixes for the recent runc vulnerability

I've started a Kubernetes supportability: external dependencies document as a coordination point to:

• gather concrete information about our existing dependencies' support timelines
• collect references to existing efforts to reduce explicit external dependencies
• identify other gaps (testing, documentation, hidden dependencies, etc) it would make sense to close

Once we have useful/completed content in that doc, we can hoist it out to a more permanent form (website documentation, etc).