Kubernetes 1.16 – how to upgrade without breaking anything.

Today, September 18, the new version of Kubernetes — 1.16 is being released. As always, we can expect many improvements and new features. But I would like to draw your attention to the Action Required sections of the file CHANGELOG-1.16.md. These sections detail changes that might break your application, cluster maintenance tools, or require modifications to configuration files.

In general, they require manual intervention…

Let's start with a change that will likely affect everyone who has been working with Kubernetes for a while. The Kubernetes API has stopped supporting deprecated API resource versions.

For those who didn't know, or forgot…The API version of a resource is specified in the manifest, in the field apiVersion: apps/v1

Namely:

Resource type
Old version
What to replace it with

All resources
apps/v1beta1
apps/v1beta2
apps/v1

deployments
daemonset
replicaset
extension/v1beta1
apps/v1

networkpolicies
extensions/v1beta1
networking.k8s.io/v1

podsecuritypolicies
extensions/v1beta1
policy/v1beta1

I also want to point out that for objects of type Ingress the apiVersion to networking.k8s.io/v1beta1has also changed. The old value extensions/v1beta1 is still supported, but there’s a good reason to update this version in the manifests as well.

There are quite a few changes in various system labels (Node labels) that are set on nodes.

Kubelet has been restricted from setting arbitrary labels (previously they could be set via the startup keys kubelet --node-labels). Only this list remains of allowed:

kubernetes.io/hostname
kubernetes.io/instance-type
kubernetes.io/os
kubernetes.io/arch

beta.kubernetes.io/instance-type
beta.kubernetes.io/os
beta.kubernetes.io/arch

failure-domain.beta.kubernetes.io/zone
failure-domain.beta.kubernetes.io/region

failure-domain.kubernetes.io/zone
failure-domain.kubernetes.io/region

[*.]kubelet.kubernetes.io/*
[*.]node.kubernetes.io/*

Tags beta.kubernetes.io/metadata-proxy-ready, beta.kubernetes.io/metadata-proxy-ready and beta.kubernetes.io/kube-proxy-ds-ready are no longer added to new nodes, and various additional components have started using slightly different labels as the node selector:

Component
Old label
Current label

kube-proxy
beta.kubernetes.io/kube-proxy-ds-ready
node.kubernetes.io/kube-proxy-ds-ready

ip-mask-agent
beta.kubernetes.io/masq-agent-ds-ready
node.kubernetes.io/masq-agent-ds-ready

metadata-proxy
beta.kubernetes.io/metadata-proxy-ready
cloud.google.com/metadata-proxy-ready

kubeadm now cleans up the initial configuration file of the kubelet bootstrap-kubelet.conf. If your tools accessed this file, switch to using kubelet.conf, which contains the current access settings.

Cadvisor no longer provides metrics pod_name and container_name, if you were using them in Prometheus, switch to the metrics pod and container respectively.

The following command-line options were removed:

Component
Removed option

hyperkube
—make-symlink

kube-proxy
—resource-container

The scheduler has started using version v1beta1 of the Event API. If you are using third-party tools to interact with the Event API, switch to the current version.

A moment of humor. During the preparation of release 1.16, the following changes were made:

• the annotation scheduler.alpha.kubernetes.io/critical-pod was removed in version v1.16.0-alpha.1
• the annotation scheduler.alpha.kubernetes.io/critical-pod was restored in version v1.16.0-alpha.2
• the annotation scheduler.alpha.kubernetes.io/critical-pod in version v1.16.0-beta.1

Use the field spec.priorityClassName to specify the importance of the pod.

Source: habr.com