Kubernetes 1.17 — hogyan frissítsük, anélkül hogy elfogyjon az error budget

December 9 saw the release of the new version of Kubernetes — 1.17. Its motto is "Stability", numerous features have achieved GA status, and some deprecated features have been removed…

And, as always, our favorite section Action Required of the file CHANGELOG-1.17.md requires attention.

Let's work with our hands…

Attention, Storage!

In version 1.17, updating kubelet on the fly is not supported, as the path to block volumes has changed. Before updating the node, you need to evict all pods from it using the command kubectl drain.

Flags and gates…

In the changelog, it usually notes that some flag or feature gate was removed or added, but for some reason, it never mentions the application that underwent this change…:

• The flag --include-uninitialized sa-logic-subsets-canary-vs.yaml kubectl;
• The functionality allowed by the feature gates GCERegionalPersistentDisk, EnableAggregatedDiscoveryTimeout és Állandó Helyi Tárhelyek, is now always used and cannot be disabled. These options have been removed from the possible keys api-server és controller-manager;
• The network IP addresses for services are no longer assigned by default. You must specify it using the flag --service-cluster-ip-range when starting the API server and controller-manager.

kubeadm

• Kubeadm has learned to set up automatic certificate updates for kubelet on all cluster nodes, including the first master where the command was executed kubeadm init. A side effect has been the requirement for a file with the initial kubelet configuration bootstrap-kubelet.conf $CI_COMMIT_TAG kubelet.conf during execution kubeadm init;
• When adding authorization modes to the API szerver kubeadm no longer injects the modes Node, RBAC into the static pod manifest, allowing for a complete configuration change.

RBAC

Built-in cluster roles have been removed system:csi-external-provisioner és system:csi-external-attacher.

Deprecated…

Some features have been declared deprecated, but they are still supported. However, we would particularly like to highlight the transition to using ContainerStorageInterface. Administrators who have deployed their own (non-managed) clusters in AWS and GCE should plan to migrate to using CSI Driver for working with persistent volumes — instead of the drivers built into Kubernetes. The CSIMigration procedure should assist them — we are waiting for the step-by-step guide to appear. Administrators using other providers for connecting persistent disks should start looking for and reading documentation: version 1.21 promises to finally remove all built-in drivers.

Forrás: habr.com