Update to Kubernetes v1.14

[mikkeloscar]

• https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1140

• https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1141

• https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1142

• https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1143

• https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1144

• Removed the compliance_checker_enabled flag used to select between different versions of the image-policy-webhook since this has now diverged too much to make sense to keep in place going forward.

Status

Relevant Changelog changes

New Features

• Pid Limiting is Graduating to Beta (#757)
  • Enable

Changes

• kubelet (read-before-upgrade)
  • Health check (liveness & readiness) probes using an HTTPGetAction will no
    longer follow redirects (#75416)
    • Mention in announcement
• client-go (read-before-upgrade)
  • The deprecated versionless API group accessors (like clientset.Apps()) have
    been removed. Use an explicit version instead (like clientset.AppsV1())
    (#74422)
    • Maybe mention in announcement
• Any Prometheus queries that match pod_name and container_name labels (e.g.
  cadvisor or kubelet probe metrics) should be updated to use pod and container
  instead. pod_name and container_name labels will be present alongside pod and
  container labels for one transitional release and removed in the future.
  (#69099)
  • Check our metrics which may depend on this

Deprecations

• kubectl

  • The --export flag for the kubectl get command is deprecated and will be
    removed in v1.18.
    (#73787)
    • Mention in announcement to users

• API

  • Ingress resources are now available via networking.k8s.io/v1beta1. Ingress resources in extensions/v1beta1 are deprecated and will no longer be served in v1.18. Existing persisted data is available via the new API group/version (#74057, @liggitt)
    • Plan how to migrate user resources.
    • Migrate Ingress resources/e2e tests in this repo.
  • PodSecurityPolicy resources will no longer be served from extensions/v1beta1 in v1.16. Migrate to the policy/v1beta1 API, available since v1.10. Existing persisted data can be retrieved via the policy/v1beta1 API.
    • Update our resources
  • DaemonSet, Deployment, and ReplicaSet resources will no longer be served from extensions/v1beta1, apps/v1beta1, or apps/v1beta2 in v1.16. Migrate to the apps/v1 API, available since v1.9. Existing persisted data can be retrieved via the apps/v1 API.
    • Plan how to migrate user resources
  • PriorityClass resources have been promoted to scheduling.k8s.io/v1 with no changes. The scheduling.k8s.io/v1beta1 and scheduling.k8s.io/v1alpha1 versions are now deprecated and will stop being served by default in v1.17. (#73555, #74465,
    @bsalamat)
    • Update our resources

• CoreDNS: The following directives or keywords are deprecated and will be removed in v1.15:

  • upstream option of kubernetes plugin, becoming default behavior in v1.15.
  • proxy plugin replaced by forward plugin
  • Update our CoreDNS configuration

Removed/deprecated metrics

• Migrate metrics we depend on

Notable features

• The RunAsGroup feature has been promoted to beta and enabled by default. PodSpec and PodSecurityPolicy objects can be used to control the primary GID of containers on supported container runtimes. (#73007, @krmayankk)
• kubectl supports copying files with wild card (#72641, @dixudx)
  • Relevant for announcement

Detailed Bug Fixes And Changes

Node

• kubelet now accepts pid=<number> in the --system-reserved and --kube-reserved options to ensure that the specified number of process IDs will be reserved for the system as a whole and for Kubernetes system daemons respectively. Please reference Kube Reserved and System Reserved in Reserve Compute Resources for System Daemons in the Kubernetes documentation for general discussion of resource reservation. To utilize this functionality, you must set the feature gate SupportNodePidsLimit=true (#73651, @RobertKrawitz)

External Dependencies

• Update CAdvisor >=v0.33.1
• Update Cluster Autoscaler fork to be based on version 1.14.2 of upstream Cluster Autoscaler.

[aermakov-zalando]

👍

[arjunrn]

👍