Kubernetes 1.17 — how to upgrade without exhausting the entire error budget

On December 9, the latest version of Kubernetes — 1.17 was released. Its motto is 'Stability', many features have been marked as GA, and a number of deprecated features have been removed…

And, as always, our favorite section Action Required of the file CHANGELOG-1.17.md requires attention.

Let’s get to work…

Attention, Storage !

The in-place upgrade of kubelet in version 1.17 is not supported because the path to block volumes has changed. All pods must be evacuated from the node using the command before upgrading the node kubectl drain.

Flags and gates…

Changelogs usually state that this flag or feature gate has been removed or added, but they somehow never mention the application affected by the change…:

• The flag --include-uninitialized at kubectl;
• The functionality allowed by feature gates GCERegionalPersistentDisk, EnableAggregatedDiscoveryTimeout and Persistent Local Volumes, is now always used and cannot be disabled. These options have been removed from possible keys api-server and controller-manager;
• The network of IP addresses for services is no longer assigned by default. It must be specified using the flag --service-cluster-ip-range when starting the API server and controller-manager.

kubeadm

• Kubeadm has learned to configure automatic certificate renewal for kubelet on all nodes in the cluster, including the first master where the command was run kubeadm init. A side effect is the requirement for a kubelet initial configuration file bootstrap-kubelet.conf instead of kubelet.conf during runtime kubeadm init;
• When adding authorization modes to the API server kubeadm no longer includes the modes Node, RBAC in the static pod manifest, allowing for complete configuration changes.

RBAC

Built-in cluster roles have been removed system:csi-external-provisioner and system:csi-external-attacher.

Deprecated…

A number of features have been marked as deprecated, however, they are still supported. Particularly, it is important to note the transition to using the ContainerStorageInterface. Administrators who have deployed their own (non-managed) clusters on AWS and GCE should plan to migrate to using the CSI Driver for working with persistent volumes — instead of the drivers built into Kubernetes. The CSIMigration procedure should help them — we await the step-by-step guide. Administrators using other providers for connecting persistent disks should start looking for and reading the documentation: version 1.21 promises to remove all built-in drivers completely.

Source: habr.com