Kubernetes 1.16 - how to upgrade and not break anything

Today, September 18, the next version of Kubernetes is released - 1.16. As always, we are waiting for a lot of improvements and new products. But I would like to draw your attention to the Action Required sections of the file CHANGELOG-1.16.md. These sections post changes that might break your application, cluster maintenance tools, or require changes to configuration files.

In general, they require manual intervention ...

Let's start right away with a change that will most likely affect everyone who has been working with kubernetes long enough. The Kubernetes API has stopped supporting legacy versions of the Resource API.

If someone did not know, or forgot ...The API version of the resource is specified in the manifest, in the field apiVersion: apps/v1

These are:

resource type
Old version
What should be replaced

All resources
apps/v1beta1
apps/v1beta2
apps / v1

deployments
daemon set
replica set
extension/v1beta1
apps / v1

networkpolicies
extensions/v1beta1
networking.k8s.io/v1

subsecuritypolicies
extensions/v1beta1
policy/v1beta1

I also want to note that objects of type Ingress also changed apiVersion on networking.k8s.io/v1beta1. old value extensions/v1beta1 still supported, but there is a good reason to update this version in the manifests at the same time.

Quite a lot of changes in the various system labels (Node labels) that are installed on the nodes.

Kubelet was forbidden to set arbitrary labels (previously they could be set through launch keys kubelet --node-labels), leaving only this list allowed:

kubernetes.io/hostname
kubernetes.io/instance-type
kubernetes.io/os
kubernetes.io/arch

beta.kubernetes.io/instance-type
beta.kubernetes.io/os
beta.kubernetes.io/arch

failure-domain.beta.kubernetes.io/zone
failure-domain.beta.kubernetes.io/region

failure-domain.kubernetes.io/zone
failure-domain.kubernetes.io/region

[*.]kubelet.kubernetes.io/*
[*.]node.kubernetes.io/*

Tags beta.kubernetes.io/metadata-proxy-ready, beta.kubernetes.io/metadata-proxy-ready and beta.kubernetes.io/kube-proxy-ds-ready are no longer added to new nodes, and various additional components have started to use slightly different labels as node selectors:

Component
old label
Actual label

kube proxy
beta.kubernetes.io/kube-proxy-ds-ready
node.kubernetes.io/kube-proxy-ds-ready

ip-mask-agent
beta.kubernetes.io/masq-agent-ds-ready
node.kubernetes.io/masq-agent-ds-ready

metadata-proxy
beta.kubernetes.io/metadata-proxy-ready
cloud.google.com/metadata-proxy-ready

kubeadm now deletes the initial kublet configuration file after it bootstrap-kubelet.conf. If your tools accessed this file, then switch to using kubelet.conf, which stores the current access settings.

Cadvisor no longer returns metrics pod_name и container_name, if you used them in Prometheus, go to metrics pod и container respectively.

Removed the keys with the command line:

Component
Removed Key

hyperkube
--make-symlink

kube proxy
--resource-container

The scheduler began to use the v1beta1 version of the Event API. If you are using third-party tools to interact with the Event API, please switch to the latest version.

A moment of humor. During the preparation of release 1.16, the following changes were made:

• removed annotation scheduler.alpha.kubernetes.io/critical-pod in version v1.16.0-alpha.1
• returned annotation scheduler.alpha.kubernetes.io/critical-pod in version v1.16.0-alpha.2
• removed annotation scheduler.alpha.kubernetes.io/critical-pod in version v1.16.0-beta.1

Use the field spec.priorityClassName to indicate the importance of the pod.

Source: habr.com