CadolesKube
/
typhoon
mirror of https://github.com/puppetmaster/typhoon.git
7
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
typhoon/CHANGES.md

1697 lines
88 KiB
Markdown
Raw Normal View History

README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
# Typhoon
Notable changes between versions.
Update recommended Terraform provider versions * Sync Terraform provider plugin versions with those used internally
2020-07-18 22:18:45 +02:00
## Latest
Update Kubernetes from v1.19.0 to v1.19.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md#v1191
2020-09-10 05:49:52 +02:00
* Kubernetes [v1.19.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md#v1191)
Change seccomp annotations to seccompProfile * seccomp graduated to GA in Kubernetes v1.19. Support for seccomp alpha annotations will be removed in v1.22 * Replace seccomp annotations with the GA seccompProfile field in the PodTemplate securityContext * Switch profile from `docker/default` to `runtime/default` (no effective change, since docker is the runtime) * Verify with docker inspect SecurityOpt. Without the profile, you'd see `seccomp=unconfined` Related: https://github.com/poseidon/terraform-render-bootstrap/pull/215
2020-09-10 09:35:46 +02:00
* Change control plane seccomp annotations to GA `seccompProfile` ([#822](https://github.com/poseidon/typhoon/pull/822))
Update Cilium from v1.8.2 to v1.8.3 * https://github.com/cilium/cilium/releases/tag/v1.8.3
2020-09-08 06:10:27 +02:00
* Update Cilium from v1.8.2 to [v1.8.3](https://github.com/cilium/cilium/releases/tag/v1.8.3)
Update Kubernetes from v1.19.0 to v1.19.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md#v1191
2020-09-10 05:49:52 +02:00
* Update Calico from v1.15.2 to [v1.15.3](https://github.com/projectcalico/calico/releases/tag/v3.15.3)
Update Cilium from v1.8.2 to v1.8.3 * https://github.com/cilium/cilium/releases/tag/v1.8.3
2020-09-08 06:10:27 +02:00
Update Fedora CoreOS Config version from v1.0.0 to v1.1.0 * No notable changes in the config spec, just house keeping * Require any snippets customization to update to v1.1.0. Version skew between the main config and snippets will show an err message * https://github.com/coreos/fcct/blob/master/docs/configuration-v1_1.md
2020-09-11 08:38:40 +02:00
### Fedora CoreOS
* Update Fedora CoreOS Config version from v1.0.0 to v1.1.0
* Require any [snippets](https://typhoon.psdn.io/advanced/customization/#hosts) customizations to update to v1.1.0
Update IngressClass resources to networking.k8s.io/v1 * Kubernetes v1.19 graduated Ingress and IngressClass from networking.k8s.io/v1beta1 to networking.k8s.io/v1
2020-09-11 08:23:52 +02:00
### Addons
* Update IngressClass resources to `networking.k8s.io/v1` ([#824](https://github.com/poseidon/typhoon/pull/824))
Update Prometheus from v2.20.0 to v2.21.0 * https://github.com/prometheus/prometheus/releases/tag/v2.21.0
2020-09-13 04:20:54 +02:00
* Update Prometheus from v2.20.0 to [v2.21.0](https://github.com/prometheus/prometheus/releases/tag/v2.21.0)
Update IngressClass resources to networking.k8s.io/v1 * Kubernetes v1.19 graduated Ingress and IngressClass from networking.k8s.io/v1beta1 to networking.k8s.io/v1
2020-09-11 08:23:52 +02:00
Update mkdocs-material from v5.5.9 to v5.5.11
2020-08-29 22:52:16 +02:00
## v1.19.0
Update Kubernetes from v1.18.8 to v1.19.0 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md
2020-08-27 05:16:28 +02:00
* Kubernetes [v1.19.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md#v1190)
Update etcd from v3.4.10 to v3.4.12 * https://github.com/etcd-io/etcd/blob/master/CHANGELOG-3.4.md
2020-08-20 06:25:41 +02:00
* Update etcd from v3.4.10 to [v3.4.12](https://github.com/etcd-io/etcd/releases/tag/v3.4.12)
Update Kubernetes from v1.18.8 to v1.19.0 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md
2020-08-27 05:16:28 +02:00
* Update Calico from v3.15.1 to [v3.15.2](https://docs.projectcalico.org/v3.15/release-notes/)
Update etcd from v3.4.10 to v3.4.12 * https://github.com/etcd-io/etcd/blob/master/CHANGELOG-3.4.md
2020-08-20 06:25:41 +02:00
Fix SELinux race condition on non-bootstrap controllers in multi-controller (#808) * Fix race condition for bootstrap-secrets SELinux context on non-bootstrap controllers in multi-controller FCOS clusters * On first boot from disk on non-bootstrap controllers, adding bootstrap-secrets races with kubelet.service starting, which can cause the secrets assets to have the wrong label until kubelet.service restarts (service, reboot, auto-update) * This can manifest as `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` pods crashlooping on spare controllers on first cluster creation
2020-08-20 06:18:10 +02:00
### Fedora CoreOS
Update nginx-ingress from v0.34.1 to v0.35.0 * Repo changed to k8s.gcr.io/ingress-nginx/controller * https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v0.35.0
2020-08-29 22:38:28 +02:00
* Fix race condition during bootstrap of multi-controller clusters ([#808](https://github.com/poseidon/typhoon/pull/808))
* Fix SELinux label of bootstrap-secrets on non-bootstrap controllers
Fix SELinux race condition on non-bootstrap controllers in multi-controller (#808) * Fix race condition for bootstrap-secrets SELinux context on non-bootstrap controllers in multi-controller FCOS clusters * On first boot from disk on non-bootstrap controllers, adding bootstrap-secrets races with kubelet.service starting, which can cause the secrets assets to have the wrong label until kubelet.service restarts (service, reboot, auto-update) * This can manifest as `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` pods crashlooping on spare controllers on first cluster creation
2020-08-20 06:18:10 +02:00
Update Grafana from v7.1.3 to v7.1.4 * https://github.com/grafana/grafana/releases/tag/v7.1.4
2020-08-23 00:40:09 +02:00
### Addons
Add fleetlock docs and links to addons * Add links to fleetlock for Fedora CoreOS reboot coordination * https://github.com/poseidon/fleetlock
2020-08-28 08:25:44 +02:00
* Introduce [fleetlock](https://github.com/poseidon/fleetlock) for Fedora CoreOS reboot coordination ([#814](https://github.com/poseidon/typhoon/pull/814))
Update nginx-ingress from v0.34.1 to v0.35.0 * Repo changed to k8s.gcr.io/ingress-nginx/controller * https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v0.35.0
2020-08-29 22:38:28 +02:00
* Update nginx-ingress from v0.34.1 to [v0.35.0](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v0.35.0)
* Repository changed to `k8s.gcr.io/ingress-nginx/controller`
Update Grafana from v7.1.4 to v7.1.5 * https://github.com/grafana/grafana/releases/tag/v7.1.5
2020-08-27 17:52:07 +02:00
* Update Grafana from v7.1.3 to [v7.1.5](https://github.com/grafana/grafana/releases/tag/v7.1.5)
Update Grafana from v7.1.3 to v7.1.4 * https://github.com/grafana/grafana/releases/tag/v7.1.4
2020-08-23 00:40:09 +02:00
Fix SELinux race condition on non-bootstrap controllers in multi-controller (#808) * Fix race condition for bootstrap-secrets SELinux context on non-bootstrap controllers in multi-controller FCOS clusters * On first boot from disk on non-bootstrap controllers, adding bootstrap-secrets races with kubelet.service starting, which can cause the secrets assets to have the wrong label until kubelet.service restarts (service, reboot, auto-update) * This can manifest as `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` pods crashlooping on spare controllers on first cluster creation
2020-08-20 06:18:10 +02:00
## v1.18.8
Update Kubernetes from v1.18.6 to v1.18.8 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1188
2020-08-14 05:46:42 +02:00
* Kubernetes [v1.18.8](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1188)
Update Terraform migration guide SHA * Mention the first master branch SHA that introduced Terraform v0.13 forward compatibility * Link the migration guide on Github until a release is available and website docs are published
2020-08-13 09:29:25 +02:00
* Migrate from Terraform v0.12.x to v0.13.x ([#804](https://github.com/poseidon/typhoon/pull/804)) (**action required**)
Update recommended Terraform provider versions * Sync Terraform provider plugin versions to those used internally * Update mkdocs-material from v5.5.1 to v5.5.6 * Fix minor details in docs
2020-08-14 19:02:16 +02:00
* Recommend Terraform v0.13.x ([migration guide](https://typhoon.psdn.io/topics/maintenance/#terraform-versions))
Update Terraform migration guide SHA * Mention the first master branch SHA that introduced Terraform v0.13 forward compatibility * Link the migration guide on Github until a release is available and website docs are published
2020-08-13 09:29:25 +02:00
* Support automatic install of poseidon's provider plugins ([poseidon/ct](https://registry.terraform.io/providers/poseidon/ct/latest), [poseidon/matchbox](https://registry.terraform.io/providers/poseidon/matchbox/latest))
Migrate from Terraform v0.12.x to v0.13.x * Recommend Terraform v0.13.x * Support automatic install of poseidon's provider plugins * Update tutorial docs for Terraform v0.13.x * Add migration guide for Terraform v0.13.x (best-effort) * Require Terraform v0.12.26+ (migration compatibility) * Require `terraform-provider-ct` v0.6.1 * Require `terraform-provider-matchbox` v0.4.1 * Require `terraform-provider-digitalocean` v1.20+ Related: * https://www.hashicorp.com/blog/announcing-hashicorp-terraform-0-13/ * https://www.terraform.io/upgrade-guides/0-13.html * https://registry.terraform.io/providers/poseidon/ct/latest * https://registry.terraform.io/providers/poseidon/matchbox/latest
2020-08-11 06:02:56 +02:00
* Require Terraform v0.12.26+ (migration compatibility)
* Require `terraform-provider-ct` v0.6.1
* Require `terraform-provider-matchbox` v0.4.1
Update etcd from v3.4.9 to v3.4.10 * https://github.com/etcd-io/etcd/releases/tag/v3.4.10
2020-07-18 23:08:22 +02:00
* Update etcd from v3.4.9 to [v3.4.10](https://github.com/etcd-io/etcd/releases/tag/v3.4.10)
Update CoreDNS from v1.6.7 to v1.7.0 * https://coredns.io/2020/06/15/coredns-1.7.0-release/ * Update Grafana dashboard with revised metrics names
2020-07-25 22:18:07 +02:00
* Update CoreDNS from v1.6.7 to [v1.7.0](https://coredns.io/2020/06/15/coredns-1.7.0-release/)
Update Cilium from v1.8.1 to v1.8.2 * https://github.com/cilium/cilium/releases/tag/v1.8.2
2020-07-26 01:06:27 +02:00
* Update Cilium from v1.8.1 to [v1.8.2](https://github.com/cilium/cilium/releases/tag/v1.8.2)
Update from coreos/flannel-cni to poseidon/flannel-cni * Update CNI plugins from v0.6.0 to v0.8.6 to fix several CVEs * Update the base image to alpine:3.12 * Use `flannel-cni` as an init container and remove sleep * https://github.com/poseidon/terraform-render-bootstrap/pull/205 * https://github.com/poseidon/flannel-cni * https://quay.io/repository/poseidon/flannel-cni Background * Switch from github.com/coreos/flannel-cni v0.3.0 which was last published by me in 2017 and is no longer accessible to me to maintain or patch * Port to the poseidon/flannel-cni rewrite, which releases v0.4.0 to continue the prior release numbering
2020-08-02 09:45:39 +02:00
* Update [coreos/flannel-cni](https://github.com/coreos/flannel-cni) to [poseidon/flannel-cni](https://github.com/poseidon/flannel-cni) ([#798](https://github.com/poseidon/typhoon/pull/798))
Update Terraform migration guide SHA * Mention the first master branch SHA that introduced Terraform v0.13 forward compatibility * Link the migration guide on Github until a release is available and website docs are published
2020-08-13 09:29:25 +02:00
* Update CNI plugins and fix CVEs with Flannel CNI (non-default)
Update from coreos/flannel-cni to poseidon/flannel-cni * Update CNI plugins from v0.6.0 to v0.8.6 to fix several CVEs * Update the base image to alpine:3.12 * Use `flannel-cni` as an init container and remove sleep * https://github.com/poseidon/terraform-render-bootstrap/pull/205 * https://github.com/poseidon/flannel-cni * https://quay.io/repository/poseidon/flannel-cni Background * Switch from github.com/coreos/flannel-cni v0.3.0 which was last published by me in 2017 and is no longer accessible to me to maintain or patch * Port to the poseidon/flannel-cni rewrite, which releases v0.4.0 to continue the prior release numbering
2020-08-02 09:45:39 +02:00
* Transition to a poseidon maintained container image
Update etcd from v3.4.9 to v3.4.10 * https://github.com/etcd-io/etcd/releases/tag/v3.4.10
2020-07-18 23:08:22 +02:00
Allow terraform-provider-aws v3.0+ plugin * Typhoon AWS is compatible with terraform-provider-aws v3.x releases * Continue to allow v2.23+, no v3.x specific features are used * Set required provider versions in the worker module, since it can be used independently Related: * https://github.com/terraform-providers/terraform-provider-aws/releases/tag/v3.0.0
2020-08-09 21:25:27 +02:00
### AWS
* Allow `terraform-provider-aws` v3.0+ ([#803](https://github.com/poseidon/typhoon/pull/803))
* Recommend updating `terraform-provider-aws` to v3.0+
* Continue to allow v2.23+, no v3.x specific features are used
Migrate from Terraform v0.12.x to v0.13.x * Recommend Terraform v0.13.x * Support automatic install of poseidon's provider plugins * Update tutorial docs for Terraform v0.13.x * Add migration guide for Terraform v0.13.x (best-effort) * Require Terraform v0.12.26+ (migration compatibility) * Require `terraform-provider-ct` v0.6.1 * Require `terraform-provider-matchbox` v0.4.1 * Require `terraform-provider-digitalocean` v1.20+ Related: * https://www.hashicorp.com/blog/announcing-hashicorp-terraform-0-13/ * https://www.terraform.io/upgrade-guides/0-13.html * https://registry.terraform.io/providers/poseidon/ct/latest * https://registry.terraform.io/providers/poseidon/matchbox/latest
2020-08-11 06:02:56 +02:00
### DigitalOcean
* Require `terraform-provider-digitalocean` v1.21+ for Terraform v0.13.x (unenforced)
* Require `terraform-provider-digitalocean` v1.20+ for Terraform v0.12.x
Fix flannel support on Fedora CoreOS * Fedora CoreOS now ships systemd-udev's `default.link` while Flannel relies on being able to pick its own MAC address for the `flannel.1` link for tunneled traffic to reach cni0 on the destination side, without being dropped * This change first appeared in FCOS testing-devel 32.20200624.20.1 and is the behavior going forward in FCOS since it was added to align FCOS network naming / configs with the rest of Fedora and address issues related to the default being missing * Flatcar Linux (and Container Linux) has a specific flannel.link configuration builtin, so it was not affected * https://github.com/coreos/fedora-coreos-tracker/issues/574#issuecomment-665487296 Note: Typhoon's recommended and default CNI provider is Calico, unless `networking` is set to flannel directly.
2020-08-02 06:00:39 +02:00
### Fedora CoreOS
* Fix support for Flannel with Fedora CoreOS ([#795](https://github.com/poseidon/typhoon/pull/795))
Update Grafana from v7.1.1 to v7.1.3 * https://github.com/grafana/grafana/releases/tag/v7.1.3 * https://github.com/grafana/grafana/releases/tag/v7.1.2
2020-08-09 03:59:49 +02:00
* Configure `flannel.1` link to select its own MAC address to solve flannel
pod-to-pod traffic drops starting with default link changes in Fedora CoreOS
32.20200629.3.0 ([details](https://github.com/coreos/fedora-coreos-tracker/issues/574#issuecomment-665487296))
Fix flannel support on Fedora CoreOS * Fedora CoreOS now ships systemd-udev's `default.link` while Flannel relies on being able to pick its own MAC address for the `flannel.1` link for tunneled traffic to reach cni0 on the destination side, without being dropped * This change first appeared in FCOS testing-devel 32.20200624.20.1 and is the behavior going forward in FCOS since it was added to align FCOS network naming / configs with the rest of Fedora and address issues related to the default being missing * Flatcar Linux (and Container Linux) has a specific flannel.link configuration builtin, so it was not affected * https://github.com/coreos/fedora-coreos-tracker/issues/574#issuecomment-665487296 Note: Typhoon's recommended and default CNI provider is Calico, unless `networking` is set to flannel directly.
2020-08-02 06:00:39 +02:00
Update Grafana from v7.0.6 to v7.1.0 * https://github.com/grafana/grafana/releases/tag/v7.1.0
2020-07-18 22:54:56 +02:00
#### Addons
Update Prometheus from v2.19.2 to v2.20.0 * https://github.com/prometheus/prometheus/releases/tag/v2.20.0
2020-07-26 01:37:28 +02:00
* Update Prometheus from v2.19.2 to [v2.20.0](https://github.com/prometheus/prometheus/releases/tag/v2.20.0)
Update Grafana from v7.1.1 to v7.1.3 * https://github.com/grafana/grafana/releases/tag/v7.1.3 * https://github.com/grafana/grafana/releases/tag/v7.1.2
2020-08-09 03:59:49 +02:00
* Update Grafana from v7.0.6 to [v7.1.3](https://github.com/grafana/grafana/releases/tag/v7.1.3)
Update Grafana from v7.0.6 to v7.1.0 * https://github.com/grafana/grafana/releases/tag/v7.1.0
2020-07-18 22:54:56 +02:00
Update ingress-nginx from v0.33.0 to v0.34.1 * Switch to ingress-nginx controller images from us.grc.io (eu, asia can also be used if desired) * https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v0.34.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v0.34.0
2020-07-16 07:43:49 +02:00
## v1.18.6
Update node-exporter from v1.0.0-rc.1 to v1.0.0 * https://github.com/prometheus/node_exporter/releases/tag/v1.0.0
2020-05-28 06:33:03 +02:00
Update ingress-nginx from v0.33.0 to v0.34.1 * Switch to ingress-nginx controller images from us.grc.io (eu, asia can also be used if desired) * https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v0.34.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v0.34.0
2020-07-16 07:43:49 +02:00
* Kubernetes [v1.18.6](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1186)
* Update Calico from v3.15.0 to [v3.15.1](https://docs.projectcalico.org/v3.15/release-notes/)
Update Cilium from v1.8.0 to v1.8.1 * https://github.com/cilium/cilium/releases/tag/v1.8.1
2020-07-06 00:58:34 +02:00
* Update Cilium from v1.8.0 to [v1.8.1](https://github.com/cilium/cilium/releases/tag/v1.8.1)
Update Grafana from v7.0.4 to v7.0.5 * https://github.com/grafana/grafana/releases/tag/v7.0.5
2020-07-05 01:53:21 +02:00
Update Prometheus from v2.19.1 to v2.19.2 * https://github.com/prometheus/prometheus/releases/tag/v2.19.2
2020-07-10 06:08:55 +02:00
#### Addons
Update ingress-nginx from v0.33.0 to v0.34.1 * Switch to ingress-nginx controller images from us.grc.io (eu, asia can also be used if desired) * https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v0.34.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v0.34.0
2020-07-16 07:43:49 +02:00
* Update nginx-ingress from v0.33.0 to [v0.34.1](https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.34.1)
* [ingress-nginx](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v0.34.0) will publish images only to gcr.io
Update Prometheus from v2.19.1 to v2.19.2 * https://github.com/prometheus/prometheus/releases/tag/v2.19.2
2020-07-10 06:08:55 +02:00
* Update Prometheus from v2.19.1 to [v2.19.2](https://github.com/prometheus/prometheus/releases/tag/v2.19.2)
Update Grafana from v7.0.5 to v7.0.6 * https://github.com/grafana/grafana/releases/tag/v7.0.6
2020-07-10 06:10:48 +02:00
* Update Grafana from v7.0.4 to [v7.0.6](https://github.com/grafana/grafana/releases/tag/v7.0.6)
Update Prometheus from v2.19.1 to v2.19.2 * https://github.com/prometheus/prometheus/releases/tag/v2.19.2
2020-07-10 06:08:55 +02:00
Update Grafana from v7.0.4 to v7.0.5 * https://github.com/grafana/grafana/releases/tag/v7.0.5
2020-07-05 01:53:21 +02:00
## v1.18.5
Update Kubernetes from v1.18.4 to v1.18.5 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1185
2020-06-27 22:51:20 +02:00
* Kubernetes [v1.18.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1185)
Update Prometheus from v2.19.0 to v2.19.1 * https://github.com/prometheus/prometheus/releases/tag/v2.19.1
2020-06-26 10:55:49 +02:00
* Add Cilium v1.8.0 as a (experimental) CNI provider option ([#760](https://github.com/poseidon/typhoon/pull/760))
* Set `networking` to "cilium" to enable
Update Calico from v3.14.1 to v3.15.0 * https://docs.projectcalico.org/v3.15/release-notes/
2020-06-26 11:40:12 +02:00
* Update Calico from v3.14.1 to [v3.15.0](https://docs.projectcalico.org/v3.15/release-notes/)
Update Prometheus from v2.19.0 to v2.19.1 * https://github.com/prometheus/prometheus/releases/tag/v2.19.1
2020-06-26 10:55:49 +02:00
Isolate each DigitalOcean cluster in its own VPC * DigitalOcean introduced Virtual Private Cloud (VPC) support to match other clouds and enhance the prior "private networking" feature. Before, droplet's belonging to different clusters (but residing in the same region) could reach one another (although Typhoon firewall rules prohibit this). Now, droplets in a VPC reside in their own network * https://www.digitalocean.com/docs/networking/vpc/ * Create droplet instances in a VPC per cluster. This matches the design of Typhoon AWS, Azure, and GCP. * Require `terraform-provider-digitalocean` v1.16.0+ (action required) * Output `vpc_id` for use with an attached DigitalOcean loadbalancer
2020-06-29 08:12:54 +02:00
#### DigitalOcean
* Isolate each cluster in an independent DigitalOcean VPC ([#776](https://github.com/poseidon/typhoon/pull/776))
* Create droplets in a VPC per cluster (matches Typhoon AWS, Azure, and GCP)
* Require `terraform-provider-digitalocean` v1.16.0+ (action required)
* Output `vpc_id` for use with an attached DigitalOcean [loadbalancer](https://github.com/poseidon/typhoon/blob/v1.18.5/docs/architecture/digitalocean.md#custom-load-balancer)
Remove os_image variable on Google Cloud Fedora CoreOS * In v1.18.3, the `os_stream` variable was added to select a Fedora CoreOS image stream (stable, testing, next) on AWS and Google Cloud (which publish official streams) * Remove `os_image` variable deprecated in v1.18.3. Manually uploaded images are no longer needed
2020-06-30 07:57:11 +02:00
### Fedora CoreOS
Allow using Flatcar Linux edge on Azure * Set Kubelet cgroup driver to systemd when Flatcar Linux edge is chosen Note: Typhoon module status assumes use of the stable variant of an OS channel/stream. Its possible to use earlier variants and those are sometimes tested or developed against, but stable is the recommendation
2020-06-30 10:16:24 +02:00
#### Google Cloud
Remove os_image variable on Google Cloud Fedora CoreOS * In v1.18.3, the `os_stream` variable was added to select a Fedora CoreOS image stream (stable, testing, next) on AWS and Google Cloud (which publish official streams) * Remove `os_image` variable deprecated in v1.18.3. Manually uploaded images are no longer needed
2020-06-30 07:57:11 +02:00
Promote Fedora CoreOS on Google Cloud to stable status
2020-06-30 08:09:11 +02:00
* Promote Fedora CoreOS to stable
Allow using Flatcar Linux edge on Azure * Set Kubelet cgroup driver to systemd when Flatcar Linux edge is chosen Note: Typhoon module status assumes use of the stable variant of an OS channel/stream. Its possible to use earlier variants and those are sometimes tested or developed against, but stable is the recommendation
2020-06-30 10:16:24 +02:00
* Remove `os_image` variable deprecated in v1.18.3 ([#777](https://github.com/poseidon/typhoon/pull/777))
Remove os_image variable on Google Cloud Fedora CoreOS * In v1.18.3, the `os_stream` variable was added to select a Fedora CoreOS image stream (stable, testing, next) on AWS and Google Cloud (which publish official streams) * Remove `os_image` variable deprecated in v1.18.3. Manually uploaded images are no longer needed
2020-06-30 07:57:11 +02:00
* Use `os_stream` to select a Fedora CoreOS image stream
Allow using Flatcar Linux edge on Azure * Set Kubelet cgroup driver to systemd when Flatcar Linux edge is chosen Note: Typhoon module status assumes use of the stable variant of an OS channel/stream. Its possible to use earlier variants and those are sometimes tested or developed against, but stable is the recommendation
2020-06-30 10:16:24 +02:00
### Flatcar Linux
#### Azure
* Allow using Flatcar Linux Edge by setting `os_image` to "flatcar-edge" ([#778](https://github.com/poseidon/typhoon/pull/778))
Update Prometheus from v2.19.0 to v2.19.1 * https://github.com/prometheus/prometheus/releases/tag/v2.19.1
2020-06-26 10:55:49 +02:00
#### Addons
Revert "Update Prometheus from v2.19.1 to v2.19.2" * Prometheus has not published the v1.19.2 * This reverts commit 81b6f54169119702c3cc6a3ecabca77f8646b444.
2020-06-27 23:53:58 +02:00
* Update Prometheus from v2.19.0 to [v2.19.1](https://github.com/prometheus/prometheus/releases/tag/v2.19.1)
Update Grafana from v7.0.3 to v7.0.4 * https://github.com/grafana/grafana/releases/tag/v7.0.4
2020-06-26 11:06:38 +02:00
* Update Grafana from v7.0.3 to [v7.0.4](https://github.com/grafana/grafana/releases/tag/v7.0.4)
Update Prometheus from v2.19.0 to v2.19.1 * https://github.com/prometheus/prometheus/releases/tag/v2.19.1
2020-06-26 10:55:49 +02:00
Rename controller node label and NoSchedule taint * Remove node label `node.kubernetes.io/master` from controller nodes * Use `node.kubernetes.io/controller` (present since v1.9.5, [#160](https://github.com/poseidon/typhoon/pull/160)) to node select controllers * Rename controller NoSchedule taint from `node-role.kubernetes.io/master` to `node-role.kubernetes.io/controller` * Tolerate the new taint name for workloads that may run on controller nodes and stop tolerating `node-role.kubernetes.io/master` taint
2020-06-18 07:50:12 +02:00
## v1.18.4
Update Kubernetes from v1.18.3 to v1.18.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1184
2020-06-18 04:34:50 +02:00
* Kubernetes [v1.18.4](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1184)
* Update Kubelet image publishing ([#749](https://github.com/poseidon/typhoon/pull/749))
* Build Kubelet images internally and publish to Quay and Dockerhub
Change Kubelet container image publishing * Build Kubelet container images internally and publish to Quay and Dockerhub (new) as an alternative in case of registry outage or breach * Use our infra to provide single and multi-arch (default) Kublet images for possible future use * Docs: Show how to use alternative Kubelet images via snippets and a systemd dropin (builds on #737) Changes: * Update docs with changes to Kubelet image building * If you prefer to trust images built by Quay/Dockerhub, automated image builds are still available with unique tags (albeit with some limitations): * Quay automated builds are tagged `build-{short_sha}` (limit: only amd64) * Dockerhub automated builts are tagged `build-{tag}` and `build-master` (limit: only amd64, no shas) Links: * Kubelet: https://github.com/poseidon/kubelet * Docs: https://typhoon.psdn.io/topics/security/#container-images * Registries: * quay.io/poseidon/kubelet * docker.io/psdn/kubelet
2020-05-28 10:06:26 +02:00
* [quay.io/poseidon/kubelet](https://quay.io/repository/poseidon/kubelet) (official)
* [docker.io/psdn/kubelet](https://hub.docker.com/r/psdn/kubelet) (fallback)
Update Kubernetes from v1.18.3 to v1.18.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1184
2020-06-18 04:34:50 +02:00
* Continue offering automated image builds with an alternate tag strategy (see [docs](https://typhoon.psdn.io/topics/security/#container-images))
Fix typo in DigitalOcean docs title
2020-06-17 03:23:27 +02:00
* [Document](https://typhoon.psdn.io/advanced/customization/#kubelet) use of alternate Kubelet images during registry incidents
Update Calico from v3.14.0 to v3.14.1 * https://docs.projectcalico.org/v3.14/release-notes/
2020-05-31 07:03:53 +02:00
* Update Calico from v3.14.0 to [v3.14.1](https://docs.projectcalico.org/v3.14/release-notes/)
Update Kubernetes from v1.18.3 to v1.18.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1184
2020-06-18 04:34:50 +02:00
* Fix [CVE-2020-13597](https://github.com/kubernetes/kubernetes/issues/91507)
Rename controller node label and NoSchedule taint * Remove node label `node.kubernetes.io/master` from controller nodes * Use `node.kubernetes.io/controller` (present since v1.9.5, [#160](https://github.com/poseidon/typhoon/pull/160)) to node select controllers * Rename controller NoSchedule taint from `node-role.kubernetes.io/master` to `node-role.kubernetes.io/controller` * Tolerate the new taint name for workloads that may run on controller nodes and stop tolerating `node-role.kubernetes.io/master` taint
2020-06-18 07:50:12 +02:00
* Rename controller NoSchedule taint from `node-role.kubernetes.io/master` to `node-role.kubernetes.io/controller` ([#764](https://github.com/poseidon/typhoon/pull/764))
* Tolerate the new taint name for workloads that may run on controller nodes
* Remove node label `node.kubernetes.io/master` from controller nodes ([#764](https://github.com/poseidon/typhoon/pull/764))
* Use `node.kubernetes.io/controller` (present since v1.9.5, [#160](https://github.com/poseidon/typhoon/pull/160)) to node select controllers
Fix typo in DigitalOcean docs title
2020-06-17 03:23:27 +02:00
* Remove unused Kubelet `-lock-file` and `-exit-on-lock-contention` ([#758](https://github.com/poseidon/typhoon/pull/758))
Update Calico from v3.14.0 to v3.14.1 * https://docs.projectcalico.org/v3.14/release-notes/
2020-05-31 07:03:53 +02:00
Use strict mode for Container Linux Configs * Enable terraform-provider-ct `strict` mode for parsing Container Linux Configs and snippets * Fix Container Linux Config systemd unit syntax `enable` (old) to `enabled` * Align with Fedora CoreOS which uses strict mode already
2020-06-10 07:38:32 +02:00
### Fedora CoreOS
#### Azure
* Use `strict` Fedora CoreOS Config (FCC) snippet parsing ([#755](https://github.com/poseidon/typhoon/pull/755))
Reduce Calcio MTU on Fedora CoreOS Azure * Change the Calico VXLAN interface for MTU from 1450 to 1410 * VXLAN on Azure should support MTU 1450. However, there is history where performance measures have shown that 1410 is needed to have expected performance. Flatcar Linux has the same MTU 1410 override and note * FCOS 31.20200323.3.2 was known to perform fine with 1450, but now in 31.20200517.3.0 the right value seems to be 1410
2020-06-19 08:47:35 +02:00
* Reduce Calico vxlan interface MTU to maintain performance ([#767](https://github.com/poseidon/typhoon/pull/766))
Use strict mode for Container Linux Configs * Enable terraform-provider-ct `strict` mode for parsing Container Linux Configs and snippets * Fix Container Linux Config systemd unit syntax `enable` (old) to `enabled` * Align with Fedora CoreOS which uses strict mode already
2020-06-10 07:38:32 +02:00
Fix Kubelet starting before hostname set on FCOS AWS * Fedora CoreOS `kubelet.service` can start before the hostname is set. Kubelet reads the hostname to determine the node name to register. If the hostname was read as localhost, Kubelet will continue trying to register as localhost (problem) * This race manifests as a node that appears NotReady, the Kubelet is trying to register as localhost, while the host itself (by then) has an AWS provided hostname. Restarting kubelet.service is a manual fix so Kubelet re-reads the hostname * This race could only be shown on AWS, not on Google Cloud or Azure despite attempts. Bare-metal and DigitalOcean differ and use hostname-override (e.g. afterburn) so they're not affected * Wait for nodes to have a non-localhost hostname in the oneshot that awaits /etc/resolve.conf. Typhoon has no valid cases for a node hostname being localhost (not even single-node clusters) Related Openshift: https://github.com/openshift/machine-config-operator/pull/1813 Close https://github.com/poseidon/typhoon/issues/765
2020-06-19 08:08:01 +02:00
#### AWS
* Fix Kubelet service race with hostname update ([#766](https://github.com/poseidon/typhoon/pull/766))
* Wait for a hostname to avoid Kubelet trying to register as `localhost`
Use strict mode for Container Linux Configs * Enable terraform-provider-ct `strict` mode for parsing Container Linux Configs and snippets * Fix Container Linux Config systemd unit syntax `enable` (old) to `enabled` * Align with Fedora CoreOS which uses strict mode already
2020-06-10 07:38:32 +02:00
### Flatcar Linux
* Use `strict` Container Linux Config (CLC) snippet parsing ([#755](https://github.com/poseidon/typhoon/pull/755))
* Require `terraform-provider-ct` v0.4+, recommend v0.5+ (**action required**)
Update node-exporter from v1.0.0-rc.1 to v1.0.0 * https://github.com/prometheus/node_exporter/releases/tag/v1.0.0
2020-05-28 06:33:03 +02:00
### Addons
Update nginx-ingress from v0.32.0 to v0.33.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/controller-0.33.0
2020-06-17 03:44:40 +02:00
* Update nginx-ingress from v0.32.0 to [v0.33.0](https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.33.0)
Update Prometheus from v2.19.0-rc.0 to v2.19.0 * https://github.com/prometheus/prometheus/releases/tag/v2.19.0
2020-06-10 08:05:03 +02:00
* Update Prometheus from v2.18.1 to [v2.19.0](https://github.com/prometheus/prometheus/releases/tag/v2.19.0)
Update node-exporter from v1.0.0 to v1.0.1 * https://github.com/prometheus/node_exporter/releases/tag/v1.0.1
2020-06-17 02:57:09 +02:00
* Update node-exporter from v1.0.0-rc.1 to [v1.0.1](https://github.com/prometheus/node_exporter/releases/tag/v1.0.1)
Update kube-state-metrics from v1.9.6 to v1.9.7 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.9.7
2020-06-03 20:35:10 +02:00
* Update kube-state-metrics from v1.9.6 to v1.9.7
Update Grafana from v7.0.1 to v7.0.3 * https://github.com/grafana/grafana/releases/tag/v7.0.2 * https://github.com/grafana/grafana/releases/tag/v7.0.3
2020-06-03 21:31:58 +02:00
* Update Grafana from v7.0.0 to v7.0.3
Update node-exporter from v1.0.0-rc.1 to v1.0.0 * https://github.com/prometheus/node_exporter/releases/tag/v1.0.0
2020-05-28 06:33:03 +02:00
Upgrade docs packages and refresh content * Promote DigitalOcean from alpha to beta for Fedora CoreOS and Flatcar Linux * Upgrade mkdocs-material and PyPI packages for docs * Replace docs mentions of Container Linux with Flatcar Linux and move docs/cl to docs/flatcar-linux * Deprecate CoreOS Container Linux support. Its still usable for some time, but start removing docs
2020-05-21 07:53:51 +02:00
## v1.18.3
Introduce list of detail objects for bare-metal machines * Define bare-metal `controllers` and `workers` as a complex type list(object{name=string, mac=string, domain=string}) to allow clusters with many machines to be defined more cleanly * Remove `controller_names` list variable * Remove `controller_macs` list variable * Remove `controller_domains` list variable * Remove `worker_names` list variable * Remove `worker_macs` list variable * Remove `worker_domains` list variable
2019-10-06 21:57:15 +02:00
Update Kubernetes from v1.18.3 to v1.18.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1184
2020-06-18 04:34:50 +02:00
* Kubernetes [v1.18.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1183)
Enable Kubelet TLS bootstrap and NodeRestriction * Enable bootstrap token authentication on kube-apiserver * Generate the bootstrap.kubernetes.io/token Secret that may be used as a bootstrap token * Generate a bootstrap kubeconfig (with a bootstrap token) to be securely distributed to nodes. Each Kubelet will use the bootstrap kubeconfig to authenticate to kube-apiserver as `system:bootstrappers` and send a node-unique CSR for kube-controller-manager to automatically approve to issue a Kubelet certificate and kubeconfig (expires in 72 hours) * Add ClusterRoleBinding for bootstrap token subjects (`system:bootstrappers`) to have the `system:node-bootstrapper` ClusterRole * Add ClusterRoleBinding for bootstrap token subjects (`system:bootstrappers`) to have the csr nodeclient ClusterRole * Add ClusterRoleBinding for bootstrap token subjects (`system:bootstrappers`) to have the csr selfnodeclient ClusterRole * Enable NodeRestriction admission controller to limit the scope of Node or Pod objects a Kubelet can modify to those of the node itself * Ability for a Kubelet to delete its Node object is retained as preemptible nodes or those in auto-scaling instance groups need to be able to remove themselves on shutdown. This need continues to have precedence over any risk of a node deleting itself maliciously Security notes: 1. Issued Kubelet certificates authenticate as user `system:node:NAME` and group `system:nodes` and are limited in their authorization to perform API operations by Node authorization and NodeRestriction admission. Previously, a Kubelet's authorization was broader. This is the primary security motivation. 2. The bootstrap kubeconfig credential has the same sensitivity as the previous generated TLS client-certificate kubeconfig. It must be distributed securely to nodes. Its compromise still allows an attacker to obtain a Kubelet kubeconfig 3. Bootstrapping Kubelet kubeconfig's with a limited lifetime offers a slight security improvement. * An attacker who obtains the kubeconfig can likely obtain the bootstrap kubeconfig as well, to obtain the ability to renew their access * A compromised bootstrap kubeconfig could plausibly be handled by replacing the bootstrap token Secret, distributing the token to new nodes, and expiration. Whereas a compromised TLS-client certificate kubeconfig can't be revoked (no CRL). However, replacing a bootstrap token can be impractical in real cluster environments, so the limited lifetime is mostly a theoretical benefit. * Cluster CSR objects are visible via kubectl which is nice 4. Bootstrapping node-unique Kubelet kubeconfigs means Kubelet clients have more identity information, which can improve the utility of audits and future features Rel: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/ Rel: https://github.com/poseidon/terraform-render-bootstrap/pull/185
2020-04-26 01:50:51 +02:00
* Use Kubelet [TLS bootstrap](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) with bootstrap token authentication ([#713](https://github.com/poseidon/typhoon/pull/713))
* Enable Node [Authorization](https://kubernetes.io/docs/reference/access-authn-authz/node/) and [NodeRestriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction) to reduce authorization scope
* Renew Kubelet certificates every 72 hours
Update etcd from v3.4.8 to v3.4.9 * https://github.com/etcd-io/etcd/blob/master/CHANGELOG-3.4.md#v349-2020-05-20
2020-05-22 09:50:30 +02:00
* Update etcd from v3.4.7 to [v3.4.9](https://github.com/etcd-io/etcd/releases/tag/v3.4.9)
Update Calico from v3.13.3 to v3.14.0 * https://docs.projectcalico.org/v3.14/release-notes/
2020-05-10 01:05:30 +02:00
* Update Calico from v3.13.1 to [v3.14.0](https://docs.projectcalico.org/v3.14/release-notes/)
Update etcd from v3.4.8 to v3.4.9 * https://github.com/etcd-io/etcd/blob/master/CHANGELOG-3.4.md#v349-2020-05-20
2020-05-22 09:50:30 +02:00
* Add CoreDNS node affinity preference for controller nodes ([#188](https://github.com/poseidon/terraform-render-bootstrap/pull/188))
Upgrade docs packages and refresh content * Promote DigitalOcean from alpha to beta for Fedora CoreOS and Flatcar Linux * Upgrade mkdocs-material and PyPI packages for docs * Replace docs mentions of Container Linux with Flatcar Linux and move docs/cl to docs/flatcar-linux * Deprecate CoreOS Container Linux support. Its still usable for some time, but start removing docs
2020-05-21 07:53:51 +02:00
* Deprecate CoreOS Container Linux support (no OS [updates](https://coreos.com/os/eol/) after May 2020)
* Use a `fedora-coreos` module for Fedora CoreOS
* Use a `container-linux` module for Flatcar Linux
Update Calico from v3.13.1 to v3.13.3 * https://docs.projectcalico.org/v3.13/release-notes/
2020-04-23 05:28:55 +02:00
Fix Calico install-cni crash loop on Pod restarts * Set a consistent MCS level/range for Calico install-cni * Note: Rebooting a node was a workaround, because Kubelet relabels /etc/kubernetes(/cni/net.d) Background: * On SELinux enforcing systems, the Calico CNI install-cni container ran with default SELinux context and a random MCS pair. install-cni places CNI configs by first creating a temporary file and then moving them into place, which means the file MCS categories depend on the containers SELinux context. * calico-node Pod restarts creates a new install-cni container with a different MCS pair that cannot access the earlier written file (it places configs every time), causing the init container to error and calico-node to crash loop * https://github.com/projectcalico/cni-plugin/issues/874 ``` mv: inter-device move failed: '/calico.conf.tmp' to '/host/etc/cni/net.d/10-calico.conflist'; unable to remove target: Permission denied Failed to mv files. This may be caused by selinux configuration on the host, or something else. ``` Note, this isn't a host SELinux configuration issue. Related: * https://github.com/poseidon/terraform-render-bootstrap/pull/186
2020-05-10 00:58:45 +02:00
### AWS
Update Grafana from v6.7.2 to v7.0.0-beta1 * https://github.com/grafana/grafana/releases/tag/v7.0.0-beta1
2020-04-30 05:51:45 +02:00
* Fix Terraform plan error when `controller_count` exceeds AWS zones (e.g. 5 controllers) ([#714](https://github.com/poseidon/typhoon/pull/714))
* Regressed in v1.17.1 ([#605](https://github.com/poseidon/typhoon/pull/605))
Use new Azure subnet to set address_prefixes list * Update Azure subnet `address_prefix` to `azure_prefixes` list * Fix warning that `address_prefix` is deprecated * Require `terraform-provider-azurerm` v2.8.0+ (action required) Rel: https://github.com/terraform-providers/terraform-provider-azurerm/pull/6493
2020-05-19 08:25:30 +02:00
### Azure
* Update Azure subnets to set `address_prefixes` list ([#730](https://github.com/poseidon/typhoon/pull/730))
* Fix warning that `address_prefix` is deprecated
* Require `terraform-provider-azurerm` v2.8.0+ (action required)
Upgrade docs packages and refresh content * Promote DigitalOcean from alpha to beta for Fedora CoreOS and Flatcar Linux * Upgrade mkdocs-material and PyPI packages for docs * Replace docs mentions of Container Linux with Flatcar Linux and move docs/cl to docs/flatcar-linux * Deprecate CoreOS Container Linux support. Its still usable for some time, but start removing docs
2020-05-21 07:53:51 +02:00
### DigitalOcean
* Promote DigitalOcean to beta on both Fedora CoreOS and Flatcar Linux
Fix Calico install-cni crash loop on Pod restarts * Set a consistent MCS level/range for Calico install-cni * Note: Rebooting a node was a workaround, because Kubelet relabels /etc/kubernetes(/cni/net.d) Background: * On SELinux enforcing systems, the Calico CNI install-cni container ran with default SELinux context and a random MCS pair. install-cni places CNI configs by first creating a temporary file and then moving them into place, which means the file MCS categories depend on the containers SELinux context. * calico-node Pod restarts creates a new install-cni container with a different MCS pair that cannot access the earlier written file (it places configs every time), causing the init container to error and calico-node to crash loop * https://github.com/projectcalico/cni-plugin/issues/874 ``` mv: inter-device move failed: '/calico.conf.tmp' to '/host/etc/cni/net.d/10-calico.conflist'; unable to remove target: Permission denied Failed to mv files. This may be caused by selinux configuration on the host, or something else. ``` Note, this isn't a host SELinux configuration issue. Related: * https://github.com/poseidon/terraform-render-bootstrap/pull/186
2020-05-10 00:58:45 +02:00
### Fedora CoreOS
* Fix Calico `install-cni` crashloop on Pod restarts ([#724](https://github.com/poseidon/typhoon/pull/724))
* SELinux enforcement requires consistent file context MCS level
* Restarting a node resolved the issue as a previous workaround
Support Fedora CoreOS OS image streams on AWS * Add `os_stream` variable to set the stream to stable (default), testing, or next * Remove unused os_image variable on Fedora CoreOS AWS
2020-05-14 06:37:18 +02:00
#### AWS
Upgrade docs packages and refresh content * Promote DigitalOcean from alpha to beta for Fedora CoreOS and Flatcar Linux * Upgrade mkdocs-material and PyPI packages for docs * Replace docs mentions of Container Linux with Flatcar Linux and move docs/cl to docs/flatcar-linux * Deprecate CoreOS Container Linux support. Its still usable for some time, but start removing docs
2020-05-21 07:53:51 +02:00
* Support Fedora CoreOS [image streams](https://docs.fedoraproject.org/en-US/fedora-coreos/update-streams/) ([#727](https://github.com/poseidon/typhoon/pull/727))
Support Fedora CoreOS OS image streams on AWS * Add `os_stream` variable to set the stream to stable (default), testing, or next * Remove unused os_image variable on Fedora CoreOS AWS
2020-05-14 06:37:18 +02:00
* Add `os_stream` variable to set the stream to `stable` (default), `testing`, or `next`
* Remove unused `os_image` variable
Use Fedora CoreOS image streams on Google Cloud * Add `os_stream` variable to set a Fedora CoreOS stream to `stable` (default), `testing`, or `next` * Deprecate `os_image` variable. Remove docs about uploading Fedora CoreOS images manually, this is no longer needed * https://docs.fedoraproject.org/en-US/fedora-coreos/update-streams/ Rel: https://github.com/coreos/fedora-coreos-docs/pull/70
2020-05-08 10:18:34 +02:00
#### Google
Remove os_image variable on Google Cloud Fedora CoreOS * In v1.18.3, the `os_stream` variable was added to select a Fedora CoreOS image stream (stable, testing, next) on AWS and Google Cloud (which publish official streams) * Remove `os_image` variable deprecated in v1.18.3. Manually uploaded images are no longer needed
2020-06-30 07:57:11 +02:00
* Support Fedora CoreOS [image streams](https://docs.fedoraproject.org/en-US/fedora-coreos/update-streams/) ([#723](https://github.com/poseidon/typhoon/pull/723))
Use Fedora CoreOS image streams on Google Cloud * Add `os_stream` variable to set a Fedora CoreOS stream to `stable` (default), `testing`, or `next` * Deprecate `os_image` variable. Remove docs about uploading Fedora CoreOS images manually, this is no longer needed * https://docs.fedoraproject.org/en-US/fedora-coreos/update-streams/ Rel: https://github.com/coreos/fedora-coreos-docs/pull/70
2020-05-08 10:18:34 +02:00
* Add `os_stream` variable to set the stream to `stable` (default), `testing`, or `next`
* Deprecate `os_image` variable. Manual image uploads are no longer needed
Restore use of Flatcar Linux Azure Marketplace image * Switch Flatcar Linux Azure to use the Marketplace image from Kinvolk (offer `flatcar-container-linux-free`) * Accepting Azure Marketplace terms is still neccessary, update docs to show accepting the free offer rather than BYOL * Upstream Flatcar: https://github.com/flatcar-linux/Flatcar/issues/82 * Typhoon: https://github.com/poseidon/typhoon/issues/703
2020-05-10 02:37:35 +02:00
### Flatcar Linux
#### Azure
* Use the Flatcar Linux Azure Marketplace image
* Restore [#664](https://github.com/poseidon/typhoon/pull/664) (reverted in [#707](https://github.com/poseidon/typhoon/pull/707)) but use Flatcar Linux new free offer (not byol)
* Change `os_image` to use a `flatcar-stable` default
Upgrade docs packages and refresh content * Promote DigitalOcean from alpha to beta for Fedora CoreOS and Flatcar Linux * Upgrade mkdocs-material and PyPI packages for docs * Replace docs mentions of Container Linux with Flatcar Linux and move docs/cl to docs/flatcar-linux * Deprecate CoreOS Container Linux support. Its still usable for some time, but start removing docs
2020-05-21 07:53:51 +02:00
#### Google
* Promote Flatcar Linux to beta
Update Grafana from v7.0.0-beta3 to v7.0.0 * https://github.com/grafana/grafana/releases/tag/7.0.0
2020-05-16 02:38:59 +02:00
### Addons
Update Prometheus from v2.17.1 to v2.17.2 * https://github.com/prometheus/prometheus/releases/tag/v2.17.2
2020-04-21 03:09:24 +02:00
Update nginx-ingress from v0.30.0 to v0.32.0 * Add support for IngressClass and RBAC authorization * Since our nginx ingress controller example uses the flag `--ingress-class=public`, add an IngressClass to go along with it Rel: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class
2020-05-04 08:18:47 +02:00
* Update nginx-ingress from v0.30.0 to [v0.32.0](https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.32.0)
* Add support for [IngressClass](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class)
Update Prometheus from v2.18.0 to v2.18.1 * https://github.com/prometheus/prometheus/releases/tag/v2.18.1
2020-05-08 07:59:11 +02:00
* Update Prometheus from v2.17.1 to v2.18.1
Update kube-state-metrics from v1.9.5 to v1.9.6 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.9.6
2020-05-16 02:42:24 +02:00
* Update kube-state-metrics from v1.9.5 to [v1.9.6](https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.9.6)
Update node-exporter from v1.0.0-rc.0 to v1.0.0-rc.1 * https://github.com/prometheus/node_exporter/releases/tag/v1.0.0-rc.1
2020-05-16 03:03:19 +02:00
* Update node-exporter from v1.0.0-rc.0 to [v1.0.0-rc.1](https://github.com/prometheus/node_exporter/releases/tag/v1.0.0-rc.1)
Update Grafana from v7.0.0-beta2 to v7.0.0 * https://grafana.com/docs/grafana/latest/guides/whats-new-in-v7-0/
2020-05-19 08:42:32 +02:00
* Update Grafana from v6.7.2 to [v7.0.0](https://grafana.com/docs/grafana/latest/guides/whats-new-in-v7-0/)
Update Prometheus from v2.17.1 to v2.17.2 * https://github.com/prometheus/prometheus/releases/tag/v2.17.2
2020-04-21 03:09:24 +02:00
Fix race condition creating DigitalOcean firewall rules * DigitalOcean firewall rules should reference Terraform tag resources rather than using tag strings. Otherwise, terraform apply can fail (neeeds rerun) if a tag has not yet been created
2020-04-20 01:44:26 +02:00
## v1.18.2
Update Kubernetes from v1.18.1 to v1.18.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#changelog-since-v1181
2020-04-17 08:40:52 +02:00
* Kubernetes [v1.18.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1182)
Change `container-linux` module preference to Flatcar Linux * No change to Fedora CoreOS modules * For Container Linx AWS and Azure, change the `os_image` default from coreos-stable to flatcar-stable * For Container Linux GCP and DigitalOcean, change `os_image` to be required since users should upload a Flatcar Linux image and set the variable * For Container Linux bare-metal, recommend users change the `os_channel` to Flatcar Linux. No actual module change.
2020-04-11 23:52:30 +02:00
* Choose Fedora CoreOS or Flatcar Linux (**action required**)
* Use a `fedora-coreos` module for Fedora CoreOS
* Use a `container-linux` module for Flatcar Linux
Revert Flatcar Linux Azure to manual upload images * Initial support for Flatcar Linux on Azure used the Flatcar Linux Azure Marketplace images (e.g. `flatcar-stable`) in https://github.com/poseidon/typhoon/pull/664 * Flatcar Linux Azure Marketplace images have some unresolved items https://github.com/poseidon/typhoon/issues/703 * Until the Marketplace items are resolved, revert to requiring Flatcar Linux's images be manually uploaded (like GCP and DigitalOcean)
2020-04-19 00:30:28 +02:00
* Change Container Linux modules' defaults from CoreOS Container Linux to [Flatcar Container Linux](https://typhoon.psdn.io/architecture/operating-systems/) ([#702](https://github.com/poseidon/typhoon/pull/702))
Change `container-linux` module preference to Flatcar Linux * No change to Fedora CoreOS modules * For Container Linx AWS and Azure, change the `os_image` default from coreos-stable to flatcar-stable * For Container Linux GCP and DigitalOcean, change `os_image` to be required since users should upload a Flatcar Linux image and set the variable * For Container Linux bare-metal, recommend users change the `os_channel` to Flatcar Linux. No actual module change.
2020-04-11 23:52:30 +02:00
* CoreOS Container Linux [won't receive updates](https://coreos.com/os/eol/) after May 2020
Update Kubernetes from v1.18.1 to v1.18.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#changelog-since-v1181
2020-04-17 08:40:52 +02:00
### Fedora CoreOS
Fix race condition creating DigitalOcean firewall rules * DigitalOcean firewall rules should reference Terraform tag resources rather than using tag strings. Otherwise, terraform apply can fail (neeeds rerun) if a tag has not yet been created
2020-04-20 01:44:26 +02:00
* Fix bootstrap race condition from SELinux unshared content label ([#708](https://github.com/poseidon/typhoon/pull/708))
Fix bootstrap mount to use shared volume SELinux label * Race: During initial bootstrap, static control plane pods could hang with Permission denied to bootstrap secrets. A manual fix involved restarting Kubelet, which relabeled mounts The race had no effect on subsequent reboots. * bootstrap.service runs podman with a private unshared mount of /etc/kubernetes/bootstrap-secrets which uses an SELinux MCS label with a category pair. However, bootstrap-secrets should be shared as its mounted by Docker pods kube-apiserver, kube-scheduler, and kube-controller-manager. Restarting Kubelet was a manual fix because Kubelet relabels all /etc/kubernetes * Fix bootstrap Pod to use the shared volume label, which leaves bootstrap-secrets files with SELinux level s0 without MCS * Also allow failed bootstrap.service to be re-applied. This was missing on bare-metal and AWS
2020-04-20 01:14:16 +02:00
Update Kubernetes from v1.18.1 to v1.18.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#changelog-since-v1181
2020-04-17 08:40:52 +02:00
#### Azure
* Add support for Fedora CoreOS ([#704](https://github.com/poseidon/typhoon/pull/704))
Fix race condition creating DigitalOcean firewall rules * DigitalOcean firewall rules should reference Terraform tag resources rather than using tag strings. Otherwise, terraform apply can fail (neeeds rerun) if a tag has not yet been created
2020-04-20 01:44:26 +02:00
#### DigitalOcean
* Fix race condition creating firewall allow rules ([#709](https://github.com/poseidon/typhoon/pull/709))
### Flatcar Linux
Update Kubernetes from v1.18.1 to v1.18.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#changelog-since-v1181
2020-04-17 08:40:52 +02:00
Change `container-linux` module preference to Flatcar Linux * No change to Fedora CoreOS modules * For Container Linx AWS and Azure, change the `os_image` default from coreos-stable to flatcar-stable * For Container Linux GCP and DigitalOcean, change `os_image` to be required since users should upload a Flatcar Linux image and set the variable * For Container Linux bare-metal, recommend users change the `os_channel` to Flatcar Linux. No actual module change.
2020-04-11 23:52:30 +02:00
#### AWS
Revert Flatcar Linux Azure to manual upload images * Initial support for Flatcar Linux on Azure used the Flatcar Linux Azure Marketplace images (e.g. `flatcar-stable`) in https://github.com/poseidon/typhoon/pull/664 * Flatcar Linux Azure Marketplace images have some unresolved items https://github.com/poseidon/typhoon/issues/703 * Until the Marketplace items are resolved, revert to requiring Flatcar Linux's images be manually uploaded (like GCP and DigitalOcean)
2020-04-19 00:30:28 +02:00
* Change `os_image` default from `coreos-stable` to `flatcar-stable` ([#702](https://github.com/poseidon/typhoon/pull/702))
Change `container-linux` module preference to Flatcar Linux * No change to Fedora CoreOS modules * For Container Linx AWS and Azure, change the `os_image` default from coreos-stable to flatcar-stable * For Container Linux GCP and DigitalOcean, change `os_image` to be required since users should upload a Flatcar Linux image and set the variable * For Container Linux bare-metal, recommend users change the `os_channel` to Flatcar Linux. No actual module change.
2020-04-11 23:52:30 +02:00
#### Azure
Revert Flatcar Linux Azure to manual upload images * Initial support for Flatcar Linux on Azure used the Flatcar Linux Azure Marketplace images (e.g. `flatcar-stable`) in https://github.com/poseidon/typhoon/pull/664 * Flatcar Linux Azure Marketplace images have some unresolved items https://github.com/poseidon/typhoon/issues/703 * Until the Marketplace items are resolved, revert to requiring Flatcar Linux's images be manually uploaded (like GCP and DigitalOcean)
2020-04-19 00:30:28 +02:00
* Change `os_image` to be required. Recommend uploading a Flatcar Linux image (**action required**) ([#702](https://github.com/poseidon/typhoon/pull/702))
* Disable Flatcar Linux Azure Marketplace image [support](https://github.com/poseidon/typhoon/pull/664) (**breaking**, [#707](https://github.com/poseidon/typhoon/pull/707))
* Revert to manual uploading until marketplace issue is closed ([#703](https://github.com/poseidon/typhoon/issues/703))
Change `container-linux` module preference to Flatcar Linux * No change to Fedora CoreOS modules * For Container Linx AWS and Azure, change the `os_image` default from coreos-stable to flatcar-stable * For Container Linux GCP and DigitalOcean, change `os_image` to be required since users should upload a Flatcar Linux image and set the variable * For Container Linux bare-metal, recommend users change the `os_channel` to Flatcar Linux. No actual module change.
2020-04-11 23:52:30 +02:00
#### Bare-Metal
Revert Flatcar Linux Azure to manual upload images * Initial support for Flatcar Linux on Azure used the Flatcar Linux Azure Marketplace images (e.g. `flatcar-stable`) in https://github.com/poseidon/typhoon/pull/664 * Flatcar Linux Azure Marketplace images have some unresolved items https://github.com/poseidon/typhoon/issues/703 * Until the Marketplace items are resolved, revert to requiring Flatcar Linux's images be manually uploaded (like GCP and DigitalOcean)
2020-04-19 00:30:28 +02:00
* Recommend changing [os_channel](https://typhoon.psdn.io/cl/bare-metal/#required) from `coreos-stable` to `flatcar-stable`
Change `container-linux` module preference to Flatcar Linux * No change to Fedora CoreOS modules * For Container Linx AWS and Azure, change the `os_image` default from coreos-stable to flatcar-stable * For Container Linux GCP and DigitalOcean, change `os_image` to be required since users should upload a Flatcar Linux image and set the variable * For Container Linux bare-metal, recommend users change the `os_channel` to Flatcar Linux. No actual module change.
2020-04-11 23:52:30 +02:00
#### Google
Revert Flatcar Linux Azure to manual upload images * Initial support for Flatcar Linux on Azure used the Flatcar Linux Azure Marketplace images (e.g. `flatcar-stable`) in https://github.com/poseidon/typhoon/pull/664 * Flatcar Linux Azure Marketplace images have some unresolved items https://github.com/poseidon/typhoon/issues/703 * Until the Marketplace items are resolved, revert to requiring Flatcar Linux's images be manually uploaded (like GCP and DigitalOcean)
2020-04-19 00:30:28 +02:00
* Change `os_image` to be required. Recommend uploading a Flatcar Linux image (**action required**) ([#702](https://github.com/poseidon/typhoon/pull/702))
Change `container-linux` module preference to Flatcar Linux * No change to Fedora CoreOS modules * For Container Linx AWS and Azure, change the `os_image` default from coreos-stable to flatcar-stable * For Container Linux GCP and DigitalOcean, change `os_image` to be required since users should upload a Flatcar Linux image and set the variable * For Container Linux bare-metal, recommend users change the `os_channel` to Flatcar Linux. No actual module change.
2020-04-11 23:52:30 +02:00
#### DigitalOcean
Revert Flatcar Linux Azure to manual upload images * Initial support for Flatcar Linux on Azure used the Flatcar Linux Azure Marketplace images (e.g. `flatcar-stable`) in https://github.com/poseidon/typhoon/pull/664 * Flatcar Linux Azure Marketplace images have some unresolved items https://github.com/poseidon/typhoon/issues/703 * Until the Marketplace items are resolved, revert to requiring Flatcar Linux's images be manually uploaded (like GCP and DigitalOcean)
2020-04-19 00:30:28 +02:00
* Change `os_image` to be required. Recommend uploading a Flatcar Linux image (**action required**) ([#702](https://github.com/poseidon/typhoon/pull/702))
Fix race condition creating DigitalOcean firewall rules * DigitalOcean firewall rules should reference Terraform tag resources rather than using tag strings. Otherwise, terraform apply can fail (neeeds rerun) if a tag has not yet been created
2020-04-20 01:44:26 +02:00
* Fix race condition creating firewall allow rules ([#709](https://github.com/poseidon/typhoon/pull/709))
Change `container-linux` module preference to Flatcar Linux * No change to Fedora CoreOS modules * For Container Linx AWS and Azure, change the `os_image` default from coreos-stable to flatcar-stable * For Container Linux GCP and DigitalOcean, change `os_image` to be required since users should upload a Flatcar Linux image and set the variable * For Container Linux bare-metal, recommend users change the `os_channel` to Flatcar Linux. No actual module change.
2020-04-11 23:52:30 +02:00
Update Kubernetes from v1.18.0 to v1.18.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1181
2020-04-09 04:38:46 +02:00
## v1.18.1
* Kubernetes [v1.18.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1181)
Update CHANGES for v1.18.1 release * Change order of modules in the README
2020-04-11 22:18:26 +02:00
* Choose Fedora CoreOS or Flatcar Linux (**action recommended**)
* Use a `fedora-coreos` module for Fedora CoreOS
* Use a `container-linux` module with OS set to Flatcar Linux
Update etcd from v3.4.5 to v3.4.7 * https://github.com/etcd-io/etcd/releases/tag/v3.4.7 * https://github.com/etcd-io/etcd/releases/tag/v3.4.6
2020-04-07 06:09:25 +02:00
* Update etcd from v3.4.5 to [v3.4.7](https://github.com/etcd-io/etcd/releases/tag/v3.4.7)
Change default kube-system DaemonSet tolerations * Change kube-proxy, flannel, and calico-node DaemonSet tolerations to tolerate `node.kubernetes.io/not-ready` and `node-role.kubernetes.io/master` (i.e. controllers) explicitly, rather than tolerating all taints * kube-system DaemonSets will no longer tolerate custom node taints by default. Instead, custom node taints must be enumerated to opt-in to scheduling/executing the kube-system DaemonSets * Consider setting the daemonset_tolerations variable of terraform-render-bootstrap at a later date Background: Tolerating all taints ruled out use-cases where certain nodes might legitimately need to keep kube-proxy or CNI networking disabled Related: https://github.com/poseidon/terraform-render-bootstrap/pull/179
2020-03-27 06:18:38 +01:00
* Change `kube-proxy` and `calico` or `flannel` to tolerate specific taints ([#682](https://github.com/poseidon/typhoon/pull/682))
* Tolerate master and not-ready taints, rather than tolerating all taints
Update flannel from v0.11.0 to v0.12.0 * https://github.com/coreos/flannel/releases/tag/v0.12.0
2020-04-01 03:30:10 +02:00
* Update flannel from v0.11.0 to v0.12.0 ([#690](https://github.com/poseidon/typhoon/pull/690))
Add support for Fedora CoreOS on DigitalOcean * Add `digital-ocean/fedora-coreos/kubernetes` module * DigitalOcean custom uploaded images do not permit droplet IPv6 networking
2020-04-10 08:13:08 +02:00
* Fix bootstrap when `networking` mode `flannel` (non-default) is chosen ([#689](https://github.com/poseidon/typhoon/pull/689))
* Regressed in v1.18.0 changes for Calico ([#675](https://github.com/poseidon/typhoon/pull/675))
Update flannel from v0.11.0 to v0.12.0 * https://github.com/coreos/flannel/releases/tag/v0.12.0
2020-04-01 03:30:10 +02:00
* Rename Container Linux `controller_clc_snippets` to `controller_snippets` for consistency ([#688](https://github.com/poseidon/typhoon/pull/688))
Rename Container Linux snippets variable for consistency * Rename controller_clc_snippets to controller_snippets (cloud platforms) * Rename worker_clc_snippets to worker_snippets (cloud platforms) * Rename clc_snippets to snippets (bare-metal)
2020-03-29 20:46:22 +02:00
* Rename Container Linux `worker_clc_snippets` to `worker_snippets` for consistency
* Rename Container Linux `clc_snippets` (bare-metal) to `snippets` for consistency
Add support for Fedora CoreOS on Azure * Add `azure/fedora-coreos/kubernetes` module
2020-04-13 00:49:48 +02:00
* Drop support for [gitRepo](https://kubernetes.io/docs/concepts/storage/volumes/#gitrepo) volumes ([kubelet#3](https://github.com/poseidon/kubelet/pull/3))
Add support for Fedora CoreOS on DigitalOcean * Add `digital-ocean/fedora-coreos/kubernetes` module * DigitalOcean custom uploaded images do not permit droplet IPv6 networking
2020-04-10 08:13:08 +02:00
#### Azure
Fix UDP outbound and clock sync timeouts on Azure workers * Add "lb" outbound rule for worker TCP _and_ UDP traffic * Fix Azure worker nodes clock synchronization being inactive due to timeouts reaching the CoreOS / Flatcar NTP pool * Fix Azure worker nodes not providing outbount UDP connectivity Background: Azure provides VMs outbound connectivity either by having a public IP or via an SNAT masquerade feature bundled with their virtual load balancing abstraction (in contrast with, say, a NAT gateway). Azure worker nodes have only a private IP, but are associated with the cluster load balancer's backend pool and ingress frontend IP. Outbound traffic uses SNAT with this frontend IP. A subtle detail with Azure SNAT seems to be that since both inbound lb_rule's are TCP only, outbound UDP traffic isn't SNAT'd (highlights the reasons Azure shouldn't have conflated inbound load balancing with outbound SNAT concepts). However, adding a separate outbound rule and disabling outbound SNAT on our ingress lb_rule's we can tell Azure to continue load balancing as before, and support outbound SNAT for worker traffic of both the TCP and UDP protocol. Fixes clock synchronization timeouts: ``` systemd-timesyncd[786]: Timed out waiting for reply from 45.79.36.123:123 (3.flatcar.pool.ntp.org) ``` Azure controller nodes have their own public IP, so controllers (and etcd) nodes have not had clock synchronization or outbound UDP issues
2020-04-01 05:28:27 +02:00
* Fix Azure worker UDP outbound connections ([#691](https://github.com/poseidon/typhoon/pull/691))
* Fix Azure worker clock sync timeouts
Change default kube-system DaemonSet tolerations * Change kube-proxy, flannel, and calico-node DaemonSet tolerations to tolerate `node.kubernetes.io/not-ready` and `node-role.kubernetes.io/master` (i.e. controllers) explicitly, rather than tolerating all taints * kube-system DaemonSets will no longer tolerate custom node taints by default. Instead, custom node taints must be enumerated to opt-in to scheduling/executing the kube-system DaemonSets * Consider setting the daemonset_tolerations variable of terraform-render-bootstrap at a later date Background: Tolerating all taints ruled out use-cases where certain nodes might legitimately need to keep kube-proxy or CNI networking disabled Related: https://github.com/poseidon/terraform-render-bootstrap/pull/179
2020-03-27 06:18:38 +01:00
Add support for Fedora CoreOS on DigitalOcean * Add `digital-ocean/fedora-coreos/kubernetes` module * DigitalOcean custom uploaded images do not permit droplet IPv6 networking
2020-04-10 08:13:08 +02:00
#### DigitalOcean
* Add support for Fedora CoreOS ([#699](https://github.com/poseidon/typhoon/pull/699))
Refresh Prometheus rules/alerts and Grafana dashboards * Refresh upstream Prometheus rules and alerts and Grafana dashboards * All Loki recording rules for convenience
2020-03-31 09:50:16 +02:00
#### Addons
Update Grafana from v6.7.1 to v6.7.2 * https://github.com/grafana/grafana/releases/tag/v6.7.2
2020-04-04 22:13:19 +02:00
* Refresh Prometheus rules/alerts and Grafana dashboards ([#692](https://github.com/poseidon/typhoon/pull/692))
* Update Grafana from v6.7.1 to v6.7.2
Refresh Prometheus rules/alerts and Grafana dashboards * Refresh upstream Prometheus rules and alerts and Grafana dashboards * All Loki recording rules for convenience
2020-03-31 09:50:16 +02:00
Set docker log driver to journald on Fedora CoreOS * Before Kubernetes v1.18.0, Kubelet only supported kubectl `--limit-bytes` with the Docker `json-file` log driver so the Fedora CoreOS default was overridden for conformance. See https://github.com/poseidon/typhoon/pull/642 * Kubelet v1.18+ implemented support for other docker log drivers, so the Fedora CoreOS default `journald` can be used again Rel: https://github.com/kubernetes/kubernetes/issues/86367
2020-03-26 05:23:18 +01:00
## v1.18.0
Update Kubernetes from v1.17.4 to v1.18.0 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md
2020-03-22 21:47:18 +01:00
* Kubernetes [v1.18.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1180)
Update etcd from v3.4.4 to v3.4.5 * https://github.com/etcd-io/etcd/releases/tag/v3.4.5
2020-03-19 04:50:41 +01:00
* Update etcd from v3.4.4 to [v3.4.5](https://github.com/etcd-io/etcd/releases/tag/v3.4.5)
Switch from upstream hyperkube image to individual images * Kubernetes plans to stop releasing the hyperkube container image * Upstream will continue to publish `kube-apiserver`, `kube-controller-manager`, `kube-scheduler`, and `kube-proxy` container images to `k8s.gcr.io` * Upstream will publish Kubelet only as a binary for distros to package, either as a DEB/RPM on traditional distros or a container image on container-optimized operating systems * Typhoon will package the upstream Kubelet (checksummed) and its dependencies as a container image for use on CoreOS Container Linux, Flatcar Linux, and Fedora CoreOS * Update the Typhoon container image security policy to list `quay.io/poseidon/kubelet`as an official distributed artifact Hyperkube: https://github.com/kubernetes/kubernetes/pull/88676 Kubelet Container Image: https://github.com/poseidon/kubelet Kubelet Quay Repo: https://quay.io/repository/poseidon/kubelet
2020-03-17 05:21:41 +01:00
* Switch from upstream hyperkube image to individual images ([#669](https://github.com/poseidon/typhoon/pull/669))
Add CoreOS Container Linux EOL recommendation to CHANGES * Recommend that users who have not yet tried Fedora CoreOS or Flatcar Linux do so. Likely, Container Linux will reach EOL and platform support / stability ratings will be in a mixed state. Nevertheless, folks should migrate by September.
2020-03-27 07:37:12 +01:00
* Use upstream k8s.gcr.io `kube-apiserver`, `kube-controller-manager`, `kube-scheduler`, and `kube-proxy` container images
* Use [poseidon/kubelet](https://github.com/poseidon/kubelet) to package the upstream Kubelet binary and dependencies as a container image (checksummed, automated build)
* Add [quay.io/poseidon/kubelet](https://quay.io/repository/poseidon/kubelet) as a Typhoon distributed artifact in the security policy
* Update base images from debian 9 to debian 10
* Background: Kubernetes will [stop releasing](https://github.com/kubernetes/kubernetes/pull/88676) the hyperkube container image and provide the Kubelet as a binary for packaging
* Choose Fedora CoreOS or Flatcar Linux (**action recommended**)
* Use a `fedora-coreos` module for Fedora CoreOS
* Use a `container-linux` module with OS set for Flatcar Linux (varies, see docs)
* CoreOS Container Linux [won't receive updates](https://coreos.com/os/eol/) after May 2020
Add support for Fedora CoreOS snippets * Refresh snippets customization docs * Requires terraform-provider-ct v0.5+
2020-03-29 00:11:06 +01:00
* Add support for Fedora CoreOS snippets (`terraform-provider-ct` v0.5+) ([#686](https://github.com/poseidon/typhoon/pull/686))
* Recommend updating `terraform-provider-ct` plugin from v0.4.0 to [v0.5.0](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.5.0)
Set docker log driver to journald on Fedora CoreOS * Before Kubernetes v1.18.0, Kubelet only supported kubectl `--limit-bytes` with the Docker `json-file` log driver so the Fedora CoreOS default was overridden for conformance. See https://github.com/poseidon/typhoon/pull/642 * Kubelet v1.18+ implemented support for other docker log drivers, so the Fedora CoreOS default `journald` can be used again Rel: https://github.com/kubernetes/kubernetes/issues/86367
2020-03-26 05:23:18 +01:00
* Set Fedora CoreOS log driver back to the default `journald` ([#681](https://github.com/poseidon/typhoon/pull/681))
Deprecate asset_dir variable and remove docs * Remove docs for the `asset_dir` variable and deprecate it in CHANGES. It will be removed in an upcoming release * Typhoon v1.17.0 introduced a new mechanism for managing and distributing generated assets that stopped relying on writing out to disk. `asset_dir` became optional and defaulted to being unset / off (recommended)
2020-03-25 07:53:06 +01:00
* Deprecate `asset_dir` variable and remove docs ([#678](https://github.com/poseidon/typhoon/pull/678))
Add CoreOS Container Linux EOL recommendation to CHANGES * Recommend that users who have not yet tried Fedora CoreOS or Flatcar Linux do so. Likely, Container Linux will reach EOL and platform support / stability ratings will be in a mixed state. Nevertheless, folks should migrate by September.
2020-03-27 07:37:12 +01:00
* Deprecate support for [gitRepo](https://kubernetes.io/docs/concepts/storage/volumes/#gitrepo) volumes. A future release will drop support.
Update etcd from v3.4.4 to v3.4.5 * https://github.com/etcd-io/etcd/releases/tag/v3.4.5
2020-03-19 04:50:41 +01:00
Fix Fedora CoreOS AMI to filter for stable images * Fix issue observed in us-east-1 where AMI filters chose the latest testing channel release, rather than the stable chanel * Fedora CoreOS AMI filter selects the latest image with a matching name, x86_64, and hvm, excluding dev images. Add a filter for "Fedora CoreOS stable", which seems to be the only distinguishing metadata indicating the channel
2020-03-28 20:49:03 +01:00
#### AWS
* Fix Fedora CoreOS AMI to filter for stable images ([#685](https://github.com/poseidon/typhoon/pull/685))
* Latest Fedora CoreOS `testing` or `bodhi-update` images could be chosen depending on the region
Add support for Fedora CoreOS snippets * Refresh snippets customization docs * Requires terraform-provider-ct v0.5+
2020-03-29 00:11:06 +01:00
#### Bare-Metal
Rename Container Linux snippets variable for consistency * Rename controller_clc_snippets to controller_snippets (cloud platforms) * Rename worker_clc_snippets to worker_snippets (cloud platforms) * Rename clc_snippets to snippets (bare-metal)
2020-03-29 20:46:22 +02:00
* Update Fedora CoreOS default `os_stream` from testing to stable
Add support for Fedora CoreOS snippets * Refresh snippets customization docs * Requires terraform-provider-ct v0.5+
2020-03-29 00:11:06 +01:00
Allow bootstrap re-apply for Fedora CoreOS GCP * Problem: Fedora CoreOS images are manually uploaded to GCP. When a cluster is created with a stale image, Zincati immediately checks for the latest stable image, fetches, and reboots. In practice, this can unfortunately occur exactly during the initial cluster bootstrap phase. * Recommended: Upload the latest Fedora CoreOS image regularly * Mitigation: Allow a failed bootstrap.service run (which won't touch the done ConditionalPathExists) to be re-run by running `terraforma apply` again. Add a known issue to CHANGES * Update docs to show the current Fedora CoreOS stable version to reduce likelihood users see this issue Longer term ideas: * Ideal: Fedora CoreOS publishes a stable channel. Instances will always boot with the latest image in a channel. The problem disappears since it works the same way AWS does * Timer: Consider some timer-based approach to have zincati delay any system reboots for the first ~30 min of a machine's life. Possibly just configured on the controller node https://github.com/coreos/zincati/pull/251 * External coordination: For Container Linux, locksmith filled a similar role and was disabled to allow CLUO to coordinate reboots. By running atop Kubernetes, it was not possible for the reboot to occur before cluster bootstrap * Rely on https://github.com/coreos/zincati/issues/115 to delay the reboot since bootstrap involves an SSH session * Use path-based activation of zincati on controllers and set that path at the end of the bootstrap process Rel: https://github.com/coreos/fedora-coreos-tracker/issues/239
2020-03-29 01:49:17 +01:00
#### Google Cloud
* Known: Use of stale Fedora CoreOS image may require terraform re-apply during bootstrap ([#687](https://github.com/poseidon/typhoon/pull/687))
Rename DigitalOcean image variable to os_image * Rename variable `image` to `os_image` to match the naming used for the same purpose on other supported platforms (e.g. AWS, Azure, GCP)
2020-03-25 07:45:31 +01:00
#### DigitalOcean
* Rename `image` variable to `os_image` for consistency ([#677](https://github.com/poseidon/typhoon/pull/677)) (action required)
Update Prometheus from v2.16.0 to v2.17.0-rc.3 * https://github.com/prometheus/prometheus/releases/tag/v2.17.0-rc.3
2020-03-20 06:38:05 +01:00
#### Addons
Update Prometheus from v2.17.0 to v2.17.1 * https://github.com/prometheus/prometheus/releases/tag/v2.17.1
2020-03-27 06:17:13 +01:00
* Update Prometheus from v2.16.0 to [v2.17.1](https://github.com/prometheus/prometheus/releases/tag/v2.17.1)
Update Grafana from v6.6.2 to v6.7.1 * https://github.com/grafana/grafana/releases/tag/v6.7.1
2020-03-20 06:58:59 +01:00
* Update Grafana from v6.6.2 to [v6.7.1](https://github.com/grafana/grafana/releases/tag/v6.7.1)
Update Prometheus from v2.16.0 to v2.17.0-rc.3 * https://github.com/prometheus/prometheus/releases/tag/v2.17.0-rc.3
2020-03-20 06:38:05 +01:00
Update etcd from v3.4.4 to v3.4.5 * https://github.com/etcd-io/etcd/releases/tag/v3.4.5
2020-03-19 04:50:41 +01:00
## v1.17.4
Update Kubernetes from v1.17.4 to v1.18.0 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md
2020-03-22 21:47:18 +01:00
* Kubernetes [v1.17.4](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.17.md#v1174)
Update etcd from v3.4.3 to v3.4.4 * https://github.com/etcd-io/etcd/releases/tag/v3.4.4
2020-02-26 08:36:33 +01:00
* Update etcd from v3.4.3 to [v3.4.4](https://github.com/etcd-io/etcd/releases/tag/v3.4.4)
Change Container Linux etcd-member to fetch with docker:// * Quay has historically generated ACI signatures for images to facilitate rkt's notions of verification (it allowed authors to actually sign images, though `--trust-keys-from-https` is in use since etcd and most authors don't sign images). OCI standardization didn't adopt verification ideas and checking signatures has fallen out of favor. * Fix an issue where Quay no longer seems to be generating ACI signatures for new images (e.g. quay.io/coreos/etcd:v.3.4.4) * Don't be alarmed by rkt `--insecure-options=image`. It refers to disabling image signature checking (i.e. docker pull doesn't check signatures either) * System containers for Kubelet and bootstrap have transitioned to the docker:// transport, so there is precedent and this brings all the system containers on Container Linux controllers into alignment
2020-03-02 17:11:15 +01:00
* On Container Linux, fetch using the docker transport format ([#659](https://github.com/poseidon/typhoon/pull/659))
Update CoreDNS from v1.6.6 to v1.6.7 * https://coredns.io/2020/01/28/coredns-1.6.7-release/
2020-02-19 06:45:14 +01:00
* Update CoreDNS from v1.6.6 to v1.6.7 ([#648](https://github.com/poseidon/typhoon/pull/648))
Update Calico from v3.12.0 to v3.13.1 * https://docs.projectcalico.org/v3.13/release-notes/
2020-03-13 06:59:44 +01:00
* Update Calico from v3.12.0 to [v3.13.1](https://docs.projectcalico.org/v3.13/release-notes/)
Update CoreDNS from v1.6.6 to v1.6.7 * https://coredns.io/2020/01/28/coredns-1.6.7-release/
2020-02-19 06:45:14 +01:00
Fix worker_node_labels for initial Fedora CoreOS * Add Terraform strip markers to consume beginning and trailing whitespace in templated Kubelet arguments for podman (Fedora CoreOS only) * Fix initial `worker_node_labels` being quietly ignored on Fedora CoreOS cloud platforms that offer the feature * Close https://github.com/poseidon/typhoon/issues/650
2020-02-23 00:01:57 +01:00
#### AWS
Promote Fedora CoreOS AWS and Google Cloud * Promote Fedora CoreOS AWS to stable * Promote Fedora CoreOS GCP to beta
2020-03-17 06:10:34 +01:00
* Promote Fedora CoreOS to stable ([#668](https://github.com/poseidon/typhoon/pull/668))
Use a route table with separate (rather than inline) routes * Allow users to extend the route table using a data reference and adding route resources (e.g. unusual peering setups) * Note: Internally connecting AWS clusters can reduce cross-cloud flexibility and inhibits blue-green cluster patterns. It is not recommended
2020-02-26 08:12:19 +01:00
* Allow VPC route table extension via reference ([#654](https://github.com/poseidon/typhoon/pull/654))
Add automatic worker deletion on Fedora CoreOS clouds * On clouds where workers can scale down or be preempted (AWS, GCP, Azure), shutdown runs delete-node.service to remove a node a prevent NotReady nodes from lingering * Add the delete-node.service that wasn't carried over from Container Linux and port it to use podman
2020-03-01 05:12:06 +01:00
* Fix `worker_node_labels` on Fedora CoreOS ([#651](https://github.com/poseidon/typhoon/pull/651))
* Fix automatic worker node delete on shutdown on Fedora CoreOS ([#657](https://github.com/poseidon/typhoon/pull/657))
Fix worker_node_labels for initial Fedora CoreOS * Add Terraform strip markers to consume beginning and trailing whitespace in templated Kubelet arguments for podman (Fedora CoreOS only) * Fix initial `worker_node_labels` being quietly ignored on Fedora CoreOS cloud platforms that offer the feature * Close https://github.com/poseidon/typhoon/issues/650
2020-02-23 00:01:57 +01:00
Upgrade terraform-provider-azurerm to v2.0+ * Add support for `terraform-provider-azurerm` v2.0+. Require `terraform-provider-azurerm` v2.0+ and drop v1.x support since the Azure provider major release is not backwards compatible * Use Azure's new Linux VM and Linux VM Scale Set resources * Change controller's Azure disk caching to None * Associate subnets (in addition to NICs) with security groups (aesthetic) * If set, change `worker_priority` from `Low` to `Spot` (action required) Related: * https://www.terraform.io/docs/providers/azurerm/guides/2.0-upgrade-guide.html
2020-03-08 03:40:39 +01:00
#### Azure
* Upgrade to `terraform-provider-azurerm` [v2.0+](https://www.terraform.io/docs/providers/azurerm/guides/2.0-upgrade-guide.html) (action required)
Accept initial worker node labels and taints map on bare-metal * Add `worker_node_labels` map from node name to a list of initial node label strings * Add `worker_node_taints` map from node name to a list of initial node taint strings * Unlike cloud platforms, bare-metal node labels and taints are defined via a map from node name to list of labels/taints. Bare-metal clusters may have heterogeneous hardware so per node labels and taints are accepted * Only worker node names are allowed. Workloads are not scheduled on controller nodes so altering their labels/taints isn't suitable ``` module "mercury" { ... worker_node_labels = { "node2" = ["role=special"] } worker_node_taints = { "node2" = ["role=special:NoSchedule"] } } ``` Related: https://github.com/poseidon/typhoon/issues/429
2020-03-09 04:39:18 +01:00
* Change `worker_priority` from `Low` to `Spot` if used (action required)
Upgrade terraform-provider-azurerm to v2.0+ * Add support for `terraform-provider-azurerm` v2.0+. Require `terraform-provider-azurerm` v2.0+ and drop v1.x support since the Azure provider major release is not backwards compatible * Use Azure's new Linux VM and Linux VM Scale Set resources * Change controller's Azure disk caching to None * Associate subnets (in addition to NICs) with security groups (aesthetic) * If set, change `worker_priority` from `Low` to `Spot` (action required) Related: * https://www.terraform.io/docs/providers/azurerm/guides/2.0-upgrade-guide.html
2020-03-08 03:40:39 +01:00
* Switch to Azure's new Linux VM and Linux VM Scale Set resources
* Set controller's Azure disk caching to None
* Associate subnets (in addition to NICs) with security groups (aesthetic)
Add support for Flatcar Linux on Azure * Accept `os_image` "flatcar-stable" and "flatcar-beta" to use Kinvolk's Flatcar Linux images from the Azure Marketplace Note: Flatcar Linux Azure Marketplace images require terms be accepted before use
2020-03-11 07:55:23 +01:00
* Add support for Flatcar Container Linux ([#664](https://github.com/poseidon/typhoon/pull/664))
* Requires accepting Flatcar Linux Azure Marketplace terms
Upgrade terraform-provider-azurerm to v2.0+ * Add support for `terraform-provider-azurerm` v2.0+. Require `terraform-provider-azurerm` v2.0+ and drop v1.x support since the Azure provider major release is not backwards compatible * Use Azure's new Linux VM and Linux VM Scale Set resources * Change controller's Azure disk caching to None * Associate subnets (in addition to NICs) with security groups (aesthetic) * If set, change `worker_priority` from `Low` to `Spot` (action required) Related: * https://www.terraform.io/docs/providers/azurerm/guides/2.0-upgrade-guide.html
2020-03-08 03:40:39 +01:00
Accept initial worker node labels and taints map on bare-metal * Add `worker_node_labels` map from node name to a list of initial node label strings * Add `worker_node_taints` map from node name to a list of initial node taint strings * Unlike cloud platforms, bare-metal node labels and taints are defined via a map from node name to list of labels/taints. Bare-metal clusters may have heterogeneous hardware so per node labels and taints are accepted * Only worker node names are allowed. Workloads are not scheduled on controller nodes so altering their labels/taints isn't suitable ``` module "mercury" { ... worker_node_labels = { "node2" = ["role=special"] } worker_node_taints = { "node2" = ["role=special:NoSchedule"] } } ``` Related: https://github.com/poseidon/typhoon/issues/429
2020-03-09 04:39:18 +01:00
#### Bare-Metal
* Add `worker_node_labels` map variable for per-worker node labels ([#663](https://github.com/poseidon/typhoon/pull/663))
* Add `worker_node_taints` map variable for per-worker node taints ([#663](https://github.com/poseidon/typhoon/pull/663))
Update Kubernetes from v1.17.3 to v1.17.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.17.md#v1174
2020-03-13 07:02:06 +01:00
#### DigitalOcean
* Add support for Flatcar Container Linux ([#644](https://github.com/poseidon/typhoon/pull/644))
Fix worker_node_labels for initial Fedora CoreOS * Add Terraform strip markers to consume beginning and trailing whitespace in templated Kubelet arguments for podman (Fedora CoreOS only) * Fix initial `worker_node_labels` being quietly ignored on Fedora CoreOS cloud platforms that offer the feature * Close https://github.com/poseidon/typhoon/issues/650
2020-02-23 00:01:57 +01:00
#### Google Cloud
Promote Fedora CoreOS AWS and Google Cloud * Promote Fedora CoreOS AWS to stable * Promote Fedora CoreOS GCP to beta
2020-03-17 06:10:34 +01:00
* Promote Fedora CoreOS to beta ([#668](https://github.com/poseidon/typhoon/pull/668))
Add automatic worker deletion on Fedora CoreOS clouds * On clouds where workers can scale down or be preempted (AWS, GCP, Azure), shutdown runs delete-node.service to remove a node a prevent NotReady nodes from lingering * Add the delete-node.service that wasn't carried over from Container Linux and port it to use podman
2020-03-01 05:12:06 +01:00
* Fix `worker_node_labels` on Fedora CoreOS ([#651](https://github.com/poseidon/typhoon/pull/651))
* Fix automatic worker node delete on shutdown on Fedora CoreOS ([#657](https://github.com/poseidon/typhoon/pull/657))
Fix worker_node_labels for initial Fedora CoreOS * Add Terraform strip markers to consume beginning and trailing whitespace in templated Kubelet arguments for podman (Fedora CoreOS only) * Fix initial `worker_node_labels` being quietly ignored on Fedora CoreOS cloud platforms that offer the feature * Close https://github.com/poseidon/typhoon/issues/650
2020-02-23 00:01:57 +01:00
Update Prometheus from v1.15.2 to v1.16.0 * https://github.com/prometheus/prometheus/releases/tag/v2.16.0
2020-02-14 21:10:56 +01:00
#### Addons
Update nginx-ingress from v0.29.0 to v0.30.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.30.0
2020-02-26 07:11:59 +01:00
* Update nginx-ingress from v0.28.0 to [v0.30.0](https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.30.0)
Update Prometheus from v1.15.2 to v1.16.0 * https://github.com/prometheus/prometheus/releases/tag/v2.16.0
2020-02-14 21:10:56 +01:00
* Update Prometheus from v2.15.2 to [v2.16.0](https://github.com/prometheus/prometheus/releases/tag/v2.16.0)
Refresh Prometheus alerts and Grafana dashboards * Add 2 min wait before KubeNodeUnreachable to be less noisy on premeptible clusters * Add a BlackboxProbeFailure alert for any failing probes for services annotated `prometheus.io/probe: true`
2020-03-02 08:20:33 +01:00
* Refresh Prometheus rules and alerts
* Add a BlackboxProbeFailure alert
Update kube-state-metrics from v1.9.4 to v1.9.5 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.9.5
2020-02-23 00:21:10 +01:00
* Update kube-state-metrics from v1.9.4 to v1.9.5
Update node-exporter from v0.18.1 to v1.0.0-rc.0 * Update mdadm alert rule; node-exporter adds `state` label to `node_md_disks` and removes `node_md_disks_active` * https://github.com/prometheus/node_exporter/releases/tag/v1.0.0-rc.0
2020-02-26 07:26:24 +01:00
* Update node-exporter from v0.18.1 to [v1.0.0-rc.0](https://github.com/prometheus/node_exporter/releases/tag/v1.0.0-rc.0)
Update Grafana from v6.6.1 to v6.6.2 * https://github.com/grafana/grafana/releases/tag/v6.6.2
2020-02-23 00:19:24 +01:00
* Update Grafana from v6.6.1 to v6.6.2
Refresh Prometheus alerts and Grafana dashboards * Add 2 min wait before KubeNodeUnreachable to be less noisy on premeptible clusters * Add a BlackboxProbeFailure alert for any failing probes for services annotated `prometheus.io/probe: true`
2020-03-02 08:20:33 +01:00
* Refresh Grafana dashboards
Promote Fedora CoreOS AWS and Google Cloud * Promote Fedora CoreOS AWS to stable * Promote Fedora CoreOS GCP to beta
2020-03-17 06:10:34 +01:00
* Remove Container Linux Update Operator (CLUO) addon example ([#667](https://github.com/poseidon/typhoon/pull/667))
* CLUO hasn't been in active use in our clusters and won't be relevant
beyond Container Linux. Requires patches for use on Kubernetes v1.16+
Update Prometheus from v1.15.2 to v1.16.0 * https://github.com/prometheus/prometheus/releases/tag/v2.16.0
2020-02-14 21:10:56 +01:00
Update CHANGELOG sections and links
2020-02-14 21:05:51 +01:00
## v1.17.3
Update Kubernetes from v1.17.2 to v1.17.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.17.md#v1173
2020-02-12 05:22:14 +01:00
* Kubernetes [v1.17.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.17.md#v1173)
Update Calico from v3.11.2 to v3.12.0 * https://docs.projectcalico.org/release-notes/#v3120 * Remove reverse packet filter override, since Calico no longer relies on the setting * https://github.com/coreos/fedora-coreos-tracker/issues/219 * https://github.com/projectcalico/felix/pull/2189
2020-02-06 09:29:41 +01:00
* Update Calico from v3.11.2 to v3.12.0
Set docker log driver to json-file on Fedora CoreOS * Fix the last minor issue for Fedora CoreOS clusters to pass CNCF's Kubernetes conformance tests * Kubelet supports a seldom used feature `kubectl logs --limit-bytes=N` to trim a log stream to a desired length. Kubelet handles this in the CRI driver. The Kubelet docker shim only supports the limit bytes feature when Docker is configured with the default `json-file` logging driver * CNCF conformance tests started requiring limit-bytes be supported, indirectly forcing the log driver choice until either the Kubelet or the conformance tests are fixed * Fedora CoreOS defaults Docker to use `journald` (desired). For now, as a workaround to offer conformant clusters, the log driver can be set back to `json-file`. RHEL CoreOS likely won't have noticed the non-conformance since its using crio runtime * https://github.com/kubernetes/kubernetes/issues/86367 Note: When upstream has a fix, the aim is to drop the docker config override and use the journald default
2020-02-12 06:13:58 +01:00
* Allow Fedora CoreOS clusters to pass CNCF conformance suite
* Set Docker log driver to `json-file` as a workaround
Update CHANGELOG sections and links
2020-02-14 21:05:51 +01:00
* Try Fedora CoreOS or Flatcar Linux alongside CoreOS [Container Linux](https://coreos.com/os/eol/) clusters (recommended)
Update Calico from v3.11.2 to v3.12.0 * https://docs.projectcalico.org/release-notes/#v3120 * Remove reverse packet filter override, since Calico no longer relies on the setting * https://github.com/coreos/fedora-coreos-tracker/issues/219 * https://github.com/projectcalico/felix/pull/2189
2020-02-06 09:29:41 +01:00
Promote Fedora CoreOS AWS/bare-metal to beta * Remove alpha warnings from docs headers
2020-02-13 23:25:22 +01:00
#### AWS
Update CHANGELOG sections and links
2020-02-14 21:05:51 +01:00
* Promote Fedora CoreOS to beta ([#645](https://github.com/poseidon/typhoon/pull/645))
Promote Fedora CoreOS AWS/bare-metal to beta * Remove alpha warnings from docs headers
2020-02-13 23:25:22 +01:00
Update Fedora CoreOS kernel arguments to align with upstream * Align bare-metal kernel arguments with upstream docs * Add missing initrd argument which can cause issues if not present. Fix #638 * Add tty0 and ttyS0 consoles (matches Container Linux) * Remove unused coreos.inst=yes Related: https://docs.fedoraproject.org/en-US/fedora-coreos/bare-metal/
2020-02-12 04:54:10 +01:00
#### Bare-Metal
Update CHANGELOG sections and links
2020-02-14 21:05:51 +01:00
* Promote Fedora CoreOS to beta ([#645](https://github.com/poseidon/typhoon/pull/645))
Update Fedora CoreOS kernel arguments to align with upstream * Align bare-metal kernel arguments with upstream docs * Add missing initrd argument which can cause issues if not present. Fix #638 * Add tty0 and ttyS0 consoles (matches Container Linux) * Remove unused coreos.inst=yes Related: https://docs.fedoraproject.org/en-US/fedora-coreos/bare-metal/
2020-02-12 04:54:10 +01:00
* Add Fedora CoreOS kernel arguments initrd and console ([#640](https://github.com/poseidon/typhoon/pull/640))
Add module for Fedora CoreOS on Google Cloud * Add Typhoon Fedora CoreOS on Google Cloud as alpha * Add docs on uploading the Fedora CoreOS GCP gzipped tarball to Google Cloud storage to create a boot disk image
2020-02-02 00:10:40 +01:00
#### Google Cloud
Add guide for Typhoon with Flatcar Linux on DigitalOcean * Add docs on manually uploading a Flatcar Linux DigitalOcean bin image as a custom image and using a data reference * Set status of Flatcar Linux on DigitalOcean to alpha * IPv6 is not supported for DigitalOcean custom images
2020-02-13 23:18:41 +01:00
* Add Terraform module for Fedora CoreOS ([#632](https://github.com/poseidon/typhoon/pull/632))
* Add support for Flatcar Container Linux ([#639](https://github.com/poseidon/typhoon/pull/639))
Add module for Fedora CoreOS on Google Cloud * Add Typhoon Fedora CoreOS on Google Cloud as alpha * Add docs on uploading the Fedora CoreOS GCP gzipped tarball to Google Cloud storage to create a boot disk image
2020-02-02 00:10:40 +01:00
Update Grafana from v6.5.3 to v6.6.0 * https://github.com/grafana/grafana/releases/tag/v6.6.0
2020-01-28 05:46:32 +01:00
#### Addons
Update nginx-ingress from v0.27.1 to v0.28.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.28.0
2020-01-31 03:00:23 +01:00
* Update nginx-ingress from v0.27.1 to v0.28.0
Update kube-state-metrics from v1.9.3 to v1.9.4 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.9.4
2020-02-05 06:32:53 +01:00
* Update kube-state-metrics from v1.9.3 to v1.9.4
Update Grafana from v6.6.0 to v6.6.1 * https://github.com/grafana/grafana/releases/tag/v6.6.1
2020-02-08 23:50:33 +01:00
* Update Grafana from v6.5.3 to v6.6.1
Update kube-state-metrics from v1.9.3 to v1.9.4 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.9.4
2020-02-05 06:32:53 +01:00
Update Kubernetes from v1.17.1 to v1.17.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.17.md#v1172
2020-01-22 03:27:39 +01:00
## v1.17.2
* Kubernetes [v1.17.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.17.md#v1172)
Promote Fedora CoreOS from preview to alpha in docs * Add an announcement to the website as well
2020-01-23 10:09:09 +01:00
#### AWS
* Promote Fedora CoreOS from preview to alpha
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
#### Bare-Metal
Promote Fedora CoreOS from preview to alpha in docs * Add an announcement to the website as well
2020-01-23 10:09:09 +01:00
* Promote Fedora CoreOS from preview to alpha
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
* Update Fedora CoreOS images location
* Use Fedora CoreOS production [download](https://getfedora.org/coreos/download/) streams
* Use live PXE kernel and initramfs images
Update nginx-ingress from v0.26.1 to v0.27.1 * Change runAsUser from 33 to 101 for new alpine-based image * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.27.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.27.1
2020-01-21 00:06:26 +01:00
#### Addons
Update kube-state-metrics from v1.9.2 to v1.9.3 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.9.3
2020-01-23 09:03:16 +01:00
* Update nginx-ingress from v0.26.1 to [v0.27.1](https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.27.1) ([#625](https://github.com/poseidon/typhoon/pull/625))
Update nginx-ingress from v0.26.1 to v0.27.1 * Change runAsUser from 33 to 101 for new alpine-based image * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.27.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.27.1
2020-01-21 00:06:26 +01:00
* Change runAsUser from 33 to 101 for alpine-based image
Update kube-state-metrics from v1.9.2 to v1.9.3 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.9.3
2020-01-23 09:03:16 +01:00
* Update kube-state-metrics from v1.9.2 to v1.9.3
Update nginx-ingress from v0.26.1 to v0.27.1 * Change runAsUser from 33 to 101 for new alpine-based image * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.27.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.27.1
2020-01-21 00:06:26 +01:00
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
## v1.17.1
Update Calico from v3.11.1 to v3.11.2 * https://docs.projectcalico.org/v3.11/release-notes/
2020-01-18 22:45:24 +01:00
* Kubernetes [v1.17.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.17.md#v1171)
Update CoreDNS from v1.6.5 to v1.6.6 * https://coredns.io/2019/12/11/coredns-1.6.6-release/
2019-12-22 16:40:56 +01:00
* Update CoreDNS from v1.6.5 to [v1.6.6](https://coredns.io/2019/12/11/coredns-1.6.6-release/) ([#602](https://github.com/poseidon/typhoon/pull/602))
Update Calico from v3.11.1 to v3.11.2 * https://docs.projectcalico.org/v3.11/release-notes/
2020-01-18 22:45:24 +01:00
* Update Calico from v3.10.2 to v3.11.2 ([#604](https://github.com/poseidon/typhoon/pull/604))
Inline Container Linux kubelet.service, deprecate kubelet-wrapper * Change kubelet.service on Container Linux nodes to ExecStart Kubelet inline to replace the use of the host OS kubelet-wrapper script * Express rkt run flags and volume mounts in a clear, uniform way to make the Kubelet service easier to audit, manage, and understand * Eliminate reliance on a Container Linux kubelet-wrapper script * Typhoon for Fedora CoreOS developed a kubelet.service that similarly uses an inline ExecStart (except with podman instead of rkt) and a more minimal set of volume mounts. Adopt the volume improvements: * Change Kubelet /etc/kubernetes volume to read-only * Change Kubelet /etc/resolv.conf volume to read-only * Remove unneeded /var/lib/cni volume mount Background: * kubelet-wrapper was added in CoreOS around the time of Kubernetes v1.0 to simplify running a CoreOS-built hyperkube ACI image via rkt-fly. The script defaults are no longer ideal (e.g. rkt's notion of trust dates back to quay.io ACI image serving and signing, which informed the OCI standard images we use today, though they still lack rkt's signing ideas). * Shipping kubelet-wrapper was regretted at CoreOS, but remains in the distro for compatibility. The script is not updated to track hyperkube changes, but it is stable and kubelet.env overrides bridge most gaps * Typhoon Container Linux nodes have used kubelet-wrapper to rkt/rkt-fly run the Kubelet via the official k8s.gcr.io hyperkube image using overrides (new image registry, new image format, restart handling, new mounts, new entrypoint in v1.17). * Observation: Most of what it takes to run a Kubelet container is defined in Typhoon, not in kubelet-wrapper. The wrapper's value is now undermined by having to workaround its dated defaults. Typhoon may be better served defining Kubelet.service explicitly * Typhoon for Fedora CoreOS developed a kubelet.service without the use of a host OS kubelet-wrapper which is both clearer and eliminated some volume mounts
2019-12-29 20:17:26 +01:00
* Inline Kubelet service on Container Linux nodes ([#606](https://github.com/poseidon/typhoon/pull/606))
Disable Kubelet 127.0.0.1.10248 healthz endpoint * Kubelet runs a healthz server listening on 127.0.0.1:10248 by default. Its unused by Typhoon and can be disabled * https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/
2019-12-29 20:20:59 +01:00
* Disable unused Kubelet `127.0.0.1:10248` healthz listener ([#607](https://github.com/poseidon/typhoon/pull/607))
Enable kube-proxy metrics and allow Prometheus scrapes * Configure kube-proxy --metrics-bind-address=0.0.0.0 (default 127.0.0.1) to serve metrics on 0.0.0.0:10249 * Add firewall rules to allow Prometheus (resides on a worker) to scrape kube-proxy service endpoints on controllers or workers * Add a clusterIP: None service for kube-proxy endpoint discovery
2019-12-29 21:21:49 +01:00
* Enable kube-proxy metrics and allow Prometheus scrapes
* Allow TCP/10249 traffic with worker node sources
Update CoreDNS from v1.6.5 to v1.6.6 * https://coredns.io/2019/12/11/coredns-1.6.6-release/
2019-12-22 16:40:56 +01:00
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
#### AWS
* Update Fedora CoreOS AMI filter for fedora-coreos-31 ([#620](https://github.com/poseidon/typhoon/pull/620))
Allow terraform-provider-google v3.x plugin versions * Typhoon Google Cloud is compatible with `terraform-provider-google` v3.x releases * No v3.x specific features are used, so v2.19+ provider versions are still allowed, to ease migrations
2020-01-11 22:58:23 +01:00
#### Google
* Allow `terraform-provider-google` v3.0+ ([#617](https://github.com/poseidon/typhoon/pull/617))
* Only enforce `v2.19+` to ease migration, as no v3.x features are used
Update Grafana from v6.5.1 to v6.5.2 * https://github.com/grafana/grafana/releases/tag/v6.5.2
2019-12-15 00:25:48 +01:00
#### Addons
Update Prometheus from v2.15.1 to v2.15.2 * https://github.com/prometheus/prometheus/releases/tag/v2.15.2
2020-01-07 07:08:02 +01:00
* Update Prometheus from v2.14.0 to [v2.15.2](https://github.com/prometheus/prometheus/releases/tag/v2.15.2)
Enable kube-proxy metrics and allow Prometheus scrapes * Configure kube-proxy --metrics-bind-address=0.0.0.0 (default 127.0.0.1) to serve metrics on 0.0.0.0:10249 * Add firewall rules to allow Prometheus (resides on a worker) to scrape kube-proxy service endpoints on controllers or workers * Add a clusterIP: None service for kube-proxy endpoint discovery
2019-12-29 21:21:49 +01:00
* Add discovery for kube-proxy service endpoints
Update kube-state-metrics from v1.9.1 to v1.9.2 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.9.2
2020-01-19 00:32:10 +01:00
* Update kube-state-metrics from v1.8.0 to v1.9.2
Reduce Prometheus addon's node-exporter tolerations * Change node-exporter DaemonSet tolerations from tolerating all possible NoSchedule taints to tolerating the master taint and the not ready taint (we'd like metrics regardless) * Users who add custom node taints must add their custom taints to the addon node-exporter DaemonSet. As an addon, its expected users copy and manipulate manifests out-of-band in their own systems
2020-01-07 06:14:03 +01:00
* Reduce node-exporter DaemonSet tolerations ([#614](https://github.com/poseidon/typhoon/pull/614))
Update Grafana from v6.5.2 to v6.5.3 * https://github.com/grafana/grafana/releases/tag/v6.5.3
2020-01-19 00:30:09 +01:00
* Update Grafana from v6.5.1 to v6.5.3
Update Grafana from v6.5.1 to v6.5.2 * https://github.com/grafana/grafana/releases/tag/v6.5.2
2019-12-15 00:25:48 +01:00
Update CHANGES and tutorial notes for release * Update recommended Terraform and provider plugin versions * Update the rough count of resources created per cluster since its not been refreshed in a while (will vary based on cluster options)
2019-12-11 07:56:50 +01:00
## v1.17.0
Update Kubernetes from v1.16.3 to v1.17.0 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.17.md/#v1170
2019-12-10 03:31:58 +01:00
* Kubernetes [v1.17.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.17.md#v1170)
Add/update docs for asset_dir and kubeconfig usage * Original tutorials favored including the platform (e.g. google-cloud) in modules (e.g. google-cloud-yavin). Prefer naming conventions where each module / cluster has a simple name (e.g. yavin) since the platform is usually redundant * Retain the example cluster naming themes per platform
2019-12-06 07:56:42 +01:00
* Manage clusters without using a local `asset_dir` ([#595](https://github.com/poseidon/typhoon/pull/595))
Update CHANGES and tutorial notes for release * Update recommended Terraform and provider plugin versions * Update the rough count of resources created per cluster since its not been refreshed in a while (will vary based on cluster options)
2019-12-11 07:56:50 +01:00
* Change `asset_dir` to be optional. Remove the variable to skip writing assets locally (**action recommended**)
* Allow keeping cluster assets only in Terraform state ([pluggable](https://www.terraform.io/docs/backends/types/remote.html), encryption) and allow `terraform apply` from stateless automation systems
Update Calico from v3.10.1 to v3.10.2 * https://docs.projectcalico.org/v3.10/release-notes/
2019-12-10 06:03:00 +01:00
* Improve asset unpacking on controllers
* Obtain kubeconfig from Terraform module outputs
Reduce kube-controller-manager pod eviction timeout from 5m to 1m * Reduce time to delete pods on unready nodes from 5m to 1m * Present since v1.13.3, but mistakenly removed in v1.16.0 static pod control plane migration Related: * https://github.com/poseidon/terraform-render-bootstrap/pull/148 * https://github.com/poseidon/terraform-render-bootstrap/pull/164
2019-12-09 07:54:31 +01:00
* Replace usage of `template_dir` with `templatefile` function ([#587](https://github.com/poseidon/typhoon/pull/587))
Update CHANGES and tutorial notes for release * Update recommended Terraform and provider plugin versions * Update the rough count of resources created per cluster since its not been refreshed in a while (will vary based on cluster options)
2019-12-11 07:56:50 +01:00
* Require Terraform version v0.12.6+ (**action required**)
Update CoreDNS from v1.6.2 to v1.6.5 * Add health `lameduck` option 5s. Before CoreDNS shuts down, it will wait and report unhealthy for 5s to allow time for plugins to shutdown cleanly * Minor bug fixes over a few releases * https://coredns.io/2019/08/31/coredns-1.6.3-release/ * https://coredns.io/2019/09/27/coredns-1.6.4-release/ * https://coredns.io/2019/11/05/coredns-1.6.5-release/
2019-11-14 01:42:17 +01:00
* Update CoreDNS from v1.6.2 to v1.6.5 ([#588](https://github.com/poseidon/typhoon/pull/588))
* Add health `lameduck` option to wait before shutdown
Update CHANGES and tutorial notes for release * Update recommended Terraform and provider plugin versions * Update the rough count of resources created per cluster since its not been refreshed in a while (will vary based on cluster options)
2019-12-11 07:56:50 +01:00
* Update Calico from v3.10.1 to v3.10.2 ([#599](https://github.com/poseidon/typhoon/pull/599))
Reduce kube-controller-manager pod eviction timeout from 5m to 1m * Reduce time to delete pods on unready nodes from 5m to 1m * Present since v1.13.3, but mistakenly removed in v1.16.0 static pod control plane migration Related: * https://github.com/poseidon/terraform-render-bootstrap/pull/148 * https://github.com/poseidon/terraform-render-bootstrap/pull/164
2019-12-09 07:54:31 +01:00
* Reduce pod eviction timeout for deleting pods on unready nodes from 5m to 1m ([#597](https://github.com/poseidon/typhoon/pull/597))
* Present since [v1.13.3](#v1133), but mistakenly removed in v1.16.0
Add/update docs for asset_dir and kubeconfig usage * Original tutorials favored including the platform (e.g. google-cloud) in modules (e.g. google-cloud-yavin). Prefer naming conventions where each module / cluster has a simple name (e.g. yavin) since the platform is usually redundant * Retain the example cluster naming themes per platform
2019-12-06 07:56:42 +01:00
* Add CPU requests for control plane static pods ([#589](https://github.com/poseidon/typhoon/pull/589))
Add small CPU resource requests to static pods * Set small CPU requests on static pods kube-apiserver, kube-controller-manager, and kube-scheduler to align with upstream tooling and for edge cases * Effectively, a practical case for these requests hasn't been observed. However, a small static pod CPU request may offer a slight benefit if a controller became overloaded and the below mechanisms were insufficient Existing safeguards: * Control plane nodes are tainted to isolate them from ordinary workloads. Even dense workloads can only compress CPU resources on worker nodes. * Control plane static pods use the highest priority class, so contention favors control plane pods (over say node-exporter) and CPU is compressible too. See: https://github.com/poseidon/terraform-render-bootstrap/pull/161
2019-11-14 02:13:36 +01:00
* May provide slight edge case benefits and aligns with upstream
Adopt Terraform v0.12 templatefile function * Update terraform-render-bootstrap module to adopt the Terrform v0.12 templatefile function feature to replace the use of terraform-provider-template's `template_dir` * Require Terraform v0.12.6+ which adds `for_each` Background: * `template_dir` was added to `terraform-provider-template` to add support for template directory rendering in CoreOS Tectonic Kubernetes distribution (~2017) * Terraform v0.12 introduced a native `templatefile` function and v0.12.6 introduced native `for_each` support (July 2019) that makes it possible to replace `template_dir` usage
2019-11-13 23:09:34 +01:00
Use GCP region_instance_group_manager version block format * terraform-provider-google v2.19.0 deprecates `instance_template` within `google_compute_region_instance_group_manager` in order to support a scheme with multiple version blocks. Adapt our single version to the new format to resolve deprecation warnings. * Fixes: Warning: "instance_template": [DEPRECATED] This field will be replaced by `version.instance_template` in 3.0.0 * Require terraform-provider-google v2.19.0+ (action required)
2019-11-14 02:31:11 +01:00
#### Google
* Use new `google_compute_region_instance_group_manager` version block format
* Fixes warning that `instance_template` is deprecated
Update CHANGES and tutorial notes for release * Update recommended Terraform and provider plugin versions * Update the rough count of resources created per cluster since its not been refreshed in a while (will vary based on cluster options)
2019-12-11 07:56:50 +01:00
* Require `terraform-provider-google` v2.19.0+ (**action required**)
Use GCP region_instance_group_manager version block format * terraform-provider-google v2.19.0 deprecates `instance_template` within `google_compute_region_instance_group_manager` in order to support a scheme with multiple version blocks. Adapt our single version to the new format to resolve deprecation warnings. * Fixes: Warning: "instance_template": [DEPRECATED] This field will be replaced by `version.instance_template` in 3.0.0 * Require terraform-provider-google v2.19.0+ (action required)
2019-11-14 02:31:11 +01:00
Add node-exporter alerts and Grafana dashboard * Add Prometheus alerts from node-exporter * Add Grafana dashboard nodes.json, from node-exporter * Not adding recording rules, since those are only used by some node-exporter USE dashboards not being included
2019-11-14 08:39:19 +01:00
#### Addons
Update Grafana from v6.5.0 to v6.5.1 * https://github.com/grafana/grafana/releases/tag/v6.5.1
2019-11-28 23:11:25 +01:00
* Update Grafana from v6.4.4 to [v6.5.1](https://grafana.com/docs/guides/whats-new-in-v6-5/)
Use new resource dashboards in Grafana deployment * kubernetes-mixin pod resource dashboards were split into two ConfigMap parts because they provide richer networking details * New dashboards have been used by the author at the global level, but were missing in the per-cluster Grafana tracked here
2019-11-26 07:21:24 +01:00
* Add pod networking details in dashboards ([#593](https://github.com/poseidon/typhoon/pull/593))
Add node-exporter alerts and Grafana dashboard * Add Prometheus alerts from node-exporter * Add Grafana dashboard nodes.json, from node-exporter * Not adding recording rules, since those are only used by some node-exporter USE dashboards not being included
2019-11-14 08:39:19 +01:00
* Add node alerts and Grafana dashboard from node-exporter ([#591](https://github.com/poseidon/typhoon/pull/591))
Update CHANGES and tutorial notes for release * Update recommended Terraform and provider plugin versions * Update the rough count of resources created per cluster since its not been refreshed in a while (will vary based on cluster options)
2019-12-11 07:56:50 +01:00
* Reduce Prometheus high cardinality time series ([#596](https://github.com/poseidon/typhoon/pull/596))
Add node-exporter alerts and Grafana dashboard * Add Prometheus alerts from node-exporter * Add Grafana dashboard nodes.json, from node-exporter * Not adding recording rules, since those are only used by some node-exporter USE dashboards not being included
2019-11-14 08:39:19 +01:00
Update Kubernetes from v1.16.2 to v1.16.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.16.md#v1163
2019-11-13 22:05:15 +01:00
## v1.16.3
* Kubernetes [v1.16.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.16.md#v1163)
Update etcd from v3.4.2 to v3.4.3 * etcd v3.4.3 builds with Go v1.12.12 instead of v1.12.9 and adds a few minor metrics fixes * https://github.com/etcd-io/etcd/compare/v3.4.2...v3.4.3
2019-11-07 20:12:44 +01:00
* Update etcd from v3.4.2 to v3.4.3 ([#582](https://github.com/poseidon/typhoon/pull/582))
Update Calico from v3.10.0 to v3.10.1 * https://docs.projectcalico.org/v3.10/release-notes/
2019-11-07 20:09:59 +01:00
* Upgrade Calico from v3.9.2 to [v3.10.1](https://docs.projectcalico.org/v3.10/release-notes/)
Upgrade Calico v3.9.2 to v3.10.0 * Allow advertising Kubernetes service ClusterIPs to BGPPeer routers via a BGPConfiguration * Improve EdgeRouter docs about routes and BGP * https://docs.projectcalico.org/v3.10/release-notes/ * https://docs.projectcalico.org/v3.10/networking/advertise-service-ips
2019-10-27 08:49:46 +01:00
* Allow advertising service ClusterIPs to peer routers via a [BGPConfiguration](https://docs.projectcalico.org/v3.10/networking/advertise-service-ips)
Switch kube-proxy from iptables mode to ipvs mode * Kubernetes v1.11 considered kube-proxy IPVS mode GA * Many problems were found #321 * Since then, major blockers seem to have been addressed
2019-10-16 08:31:57 +02:00
* Switch `kube-proxy` from iptables to ipvs mode ([#574](https://github.com/poseidon/typhoon/pull/574))
Update Grafana from v6.4.2 to v6.4.3 * https://github.com/grafana/grafana/releases/tag/v6.4.3
2019-10-18 09:08:39 +02:00
#### Addons
Update Prometheus from v2.14.0-rc.0 to v2.14.0 * https://github.com/prometheus/prometheus/releases/tag/v2.14.0
2019-11-13 22:41:11 +01:00
* Update Prometheus from v2.13.0 to [v2.14.0](https://github.com/prometheus/prometheus/releases/tag/v2.14.0)
Refresh Prometheus rules/alerts and Grafana dashboards * Update Prometheus rules/alerts and Grafana dashboards * Remove dashboards that were moved to node-exporter, they may be added back later if valuable * Remove kube-prometheus based rules/alerts (ClockSkew alert)
2019-10-20 02:43:47 +02:00
* Refresh rules, alerts, and dashboards from upstreams
Remove kube-state-metrics addon-resizer * addon-resizer is outdated and has been dropped from kube-state-metrics examples. Those using it should look to the cluster-proportional-vertical-autoscaler. * Eliminate addon-resizer log spew * Remove associated Role and RoleBinding * Also fix kube-state-metrics readinessProbe port
2019-10-20 03:23:26 +02:00
* Remove addon-resizer from kube-state-metrics ([#575](https://github.com/poseidon/typhoon/pull/575))
Update Grafana from v6.4.3 to v6.4.4 * https://github.com/grafana/grafana/releases/tag/v6.4.4
2019-11-07 21:00:25 +01:00
* Update Grafana from v6.4.2 to v6.4.4
Update Grafana from v6.4.2 to v6.4.3 * https://github.com/grafana/grafana/releases/tag/v6.4.3
2019-10-18 09:08:39 +02:00
## v1.16.2
Update Kubernetes from v1.16.1 to v1.16.2 * Update Calico from v3.9.1 to v3.9.2
2019-10-16 07:42:52 +02:00
* Kubernetes [v1.16.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.16.md#v1162)
* Update etcd from v3.4.1 to v3.4.2 ([#570](https://github.com/poseidon/typhoon/pull/570))
* Update Calico from v3.9.1 to [v3.9.2](https://docs.projectcalico.org/v3.9/release-notes/)
Default to Calico as the CNI provider on Azure/DigitalOcean * Change `networking` default from flannel to calico on Azure and DigitalOcean * AWS, bare-metal, and Google Cloud continue to default to Calico (as they have since v1.7.5) * Typhoon now defaults to using Calico and supporting NetworkPolicy on all platforms
2019-10-16 08:09:41 +02:00
* Default to using Calico and supporting NetworkPolicy on all platforms
#### Azure
* Change default networking provider from "flannel" to "calico" ([#573](https://github.com/poseidon/typhoon/pull/573))
Update etcd from v3.4.1 to v3.4.2 * https://github.com/etcd-io/etcd/releases/tag/v3.4.2
2019-10-15 09:06:15 +02:00
Introduce list of detail objects for bare-metal machines * Define bare-metal `controllers` and `workers` as a complex type list(object{name=string, mac=string, domain=string}) to allow clusters with many machines to be defined more cleanly * Remove `controller_names` list variable * Remove `controller_macs` list variable * Remove `controller_domains` list variable * Remove `worker_names` list variable * Remove `worker_macs` list variable * Remove `worker_domains` list variable
2019-10-06 21:57:15 +02:00
#### Bare-Metal
* Add `controllers` and `workers` as typed lists of machine detail objects ([#566](https://github.com/poseidon/typhoon/pull/566))
* Define clusters' machines cleanly and with Terraform v0.12 type constraints (**action required**, see PR example)
Cleanup CHANGES notes
2019-10-16 08:25:45 +02:00
* Remove `controller_names`, `controller_macs`, and `controller_domains` variables
* Remove `worker_names`, `worker_macs`, and `worker_domains` variables
Introduce list of detail objects for bare-metal machines * Define bare-metal `controllers` and `workers` as a complex type list(object{name=string, mac=string, domain=string}) to allow clusters with many machines to be defined more cleanly * Remove `controller_names` list variable * Remove `controller_macs` list variable * Remove `controller_domains` list variable * Remove `worker_names` list variable * Remove `worker_macs` list variable * Remove `worker_domains` list variable
2019-10-06 21:57:15 +02:00
Default to Calico as the CNI provider on Azure/DigitalOcean * Change `networking` default from flannel to calico on Azure and DigitalOcean * AWS, bare-metal, and Google Cloud continue to default to Calico (as they have since v1.7.5) * Typhoon now defaults to using Calico and supporting NetworkPolicy on all platforms
2019-10-16 08:09:41 +02:00
#### DigitalOcean
* Change default networking provider from "flannel" to "calico" ([#573](https://github.com/poseidon/typhoon/pull/573))
Update Grafana from v6.4.1 to v6.4.2 * https://github.com/grafana/grafana/releases/tag/v6.4.2
2019-10-16 07:58:43 +02:00
#### Addons
* Update Grafana from v6.4.1 to [v6.4.2](https://github.com/grafana/grafana/releases/tag/v6.4.2)
Cleanup CHANGES notes
2019-10-16 08:25:45 +02:00
* Change CLUO label from "app" to "name"
Update Grafana from v6.4.1 to v6.4.2 * https://github.com/grafana/grafana/releases/tag/v6.4.2
2019-10-16 07:58:43 +02:00
Update docs, CHANGES, and mkdocs-material * Update mkdocs-material from v4.4.2 to v4.4.3 * Update recommended Terraform provider versions * Cleanup the changelog before release
2019-10-07 03:30:07 +02:00
## v1.16.1
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
Update Kubernetes from v1.16.0 to v1.16.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.16.md#v1161
2019-10-03 06:31:55 +02:00
* Kubernetes [v1.16.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.16.md#v1161)
Update etcd from v3.4.1 to v3.4.2 * https://github.com/etcd-io/etcd/releases/tag/v3.4.2
2019-10-15 09:06:15 +02:00
* Update etcd from v3.4.0 to [v3.4.1](https://github.com/etcd-io/etcd/releases/tag/v3.4.1)
Update Calico from v3.8.2 to v3.9.1 * https://docs.projectcalico.org/v3.9/release-notes/
2019-09-29 20:22:53 +02:00
* Update Calico from v3.8.2 to [v3.9.1](https://docs.projectcalico.org/v3.9/release-notes/)
Add stricter types for bare-metal modules * Review variables available in bare-metal kubernetes modules for Container Linux and Fedora CoreOS * Deprecate cluster_domain_suffix variable * Remove deprecated container_linux_oem variable
2019-10-06 20:53:49 +02:00
* Add Terraform v0.12 variables types ([#553](https://github.com/poseidon/typhoon/pull/553), [#557](https://github.com/poseidon/typhoon/pull/557), [#560](https://github.com/poseidon/typhoon/pull/560), [#556](https://github.com/poseidon/typhoon/pull/556), [#562](https://github.com/poseidon/typhoon/pull/562))
* Deprecate `cluster_domain_suffix` variable
Update etcd from v3.4.0 to v3.4.1 * https://github.com/etcd-io/etcd/releases/tag/v3.4.1
2019-09-29 00:09:57 +02:00
Update docs and variable types for worker node_labels * Document worker pools `node_labels` variable to set the initial node labels for a homogeneous set of workers * Document `worker_node_labels` convenience variable to set the initial node labels for default worker nodes
2019-09-29 00:01:14 +02:00
#### AWS
Update docs, CHANGES, and mkdocs-material * Update mkdocs-material from v4.4.2 to v4.4.3 * Update recommended Terraform provider versions * Cleanup the changelog before release
2019-10-07 03:30:07 +02:00
* Add `worker_node_labels` variable to set initial worker node labels ([#550](https://github.com/poseidon/typhoon/pull/550))
* Add `node_labels` variable to internal `workers` pool module ([#550](https://github.com/poseidon/typhoon/pull/550))
Detect most recent Fedora CoreOS AMI in region * Detect the most recent Fedora CoreOS AMI to allow usage of Fedora CoreOS in supported regions (previously just us-east-1) * Unpin the Fedora CoreOS AMI image which was pinned to images that had been checked. This does mean if Fedora publishes a broken image, it will be selected * Filter out "dev" images which have similar naming
2019-10-07 03:05:47 +02:00
* For Fedora CoreOS, detect most recent AMI in the region
Update docs and variable types for worker node_labels * Document worker pools `node_labels` variable to set the initial node labels for a homogeneous set of workers * Document `worker_node_labels` convenience variable to set the initial node labels for default worker nodes
2019-09-29 00:01:14 +02:00
#### Azure
Add stricter types for bare-metal modules * Review variables available in bare-metal kubernetes modules for Container Linux and Fedora CoreOS * Deprecate cluster_domain_suffix variable * Remove deprecated container_linux_oem variable
2019-10-06 20:53:49 +02:00
* Promote `networking` provider Calico VXLAN out of experimental (set `networking = "calico"`)
Update docs, CHANGES, and mkdocs-material * Update mkdocs-material from v4.4.2 to v4.4.3 * Update recommended Terraform provider versions * Cleanup the changelog before release
2019-10-07 03:30:07 +02:00
* Add `worker_node_labels` variable to set initial worker node labels ([#550](https://github.com/poseidon/typhoon/pull/550))
* Add `node_labels` variable to internal `workers` pool module ([#550](https://github.com/poseidon/typhoon/pull/550))
Add stricter types for bare-metal modules * Review variables available in bare-metal kubernetes modules for Container Linux and Fedora CoreOS * Deprecate cluster_domain_suffix variable * Remove deprecated container_linux_oem variable
2019-10-06 20:53:49 +02:00
* Change `workers` module default `vm_type` to `Standard_DS1_v2` (followup to [#539](https://github.com/poseidon/typhoon/pull/539))
Update docs and variable types for worker node_labels * Document worker pools `node_labels` variable to set the initial node labels for a homogeneous set of workers * Document `worker_node_labels` convenience variable to set the initial node labels for default worker nodes
2019-09-29 00:01:14 +02:00
Fix missing comma separator on bare-metal and DO * Introduced in bare-metal and DigitalOcean in #544 while addressing possible ordering race, but after the v1.16 upgrade validation
2019-09-23 19:56:22 +02:00
#### Bare-Metal
Update docs, CHANGES, and mkdocs-material * Update mkdocs-material from v4.4.2 to v4.4.3 * Update recommended Terraform provider versions * Cleanup the changelog before release
2019-10-07 03:30:07 +02:00
* For Fedora CoreOS, use new kernel, initrd, and raw paths ([#563](https://github.com/poseidon/typhoon/pull/563))
Fix missing comma separator on bare-metal and DO * Introduced in bare-metal and DigitalOcean in #544 while addressing possible ordering race, but after the v1.16 upgrade validation
2019-09-23 19:56:22 +02:00
* Fix Terraform missing comma error ([#549](https://github.com/poseidon/typhoon/pull/549))
Add stricter types for bare-metal modules * Review variables available in bare-metal kubernetes modules for Container Linux and Fedora CoreOS * Deprecate cluster_domain_suffix variable * Remove deprecated container_linux_oem variable
2019-10-06 20:53:49 +02:00
* Remove deprecated `container_linux_oem` variable ([#562](https://github.com/poseidon/typhoon/pull/562))
Fix missing comma separator on bare-metal and DO * Introduced in bare-metal and DigitalOcean in #544 while addressing possible ordering race, but after the v1.16 upgrade validation
2019-09-23 19:56:22 +02:00
#### DigitalOcean
Add stricter types for bare-metal modules * Review variables available in bare-metal kubernetes modules for Container Linux and Fedora CoreOS * Deprecate cluster_domain_suffix variable * Remove deprecated container_linux_oem variable
2019-10-06 20:53:49 +02:00
* Promote `networking` provider Calico VXLAN out of experimental (set `networking = "calico"`)
Fix missing comma separator on bare-metal and DO * Introduced in bare-metal and DigitalOcean in #544 while addressing possible ordering race, but after the v1.16 upgrade validation
2019-09-23 19:56:22 +02:00
* Fix Terraform missing comma error ([#549](https://github.com/poseidon/typhoon/pull/549))
Update etcd from v3.4.0 to v3.4.1 * https://github.com/etcd-io/etcd/releases/tag/v3.4.1
2019-09-29 00:09:57 +02:00
#### Google Cloud
Update docs, CHANGES, and mkdocs-material * Update mkdocs-material from v4.4.2 to v4.4.3 * Update recommended Terraform provider versions * Cleanup the changelog before release
2019-10-07 03:30:07 +02:00
* Add `worker_node_labels` variable to set initial worker node labels ([#550](https://github.com/poseidon/typhoon/pull/550))
Update etcd from v3.4.0 to v3.4.1 * https://github.com/etcd-io/etcd/releases/tag/v3.4.1
2019-09-29 00:09:57 +02:00
* Add `node_labels` variable to internal `workers` module ([#550](https://github.com/poseidon/typhoon/pull/550))
Update Grafana from v6.3.5 to v6.3.6 * https://github.com/grafana/grafana/releases/tag/v6.3.6
2019-09-29 00:13:46 +02:00
#### Addons
Update Prometheus from v2.12.0 to v2.13.0 * https://github.com/prometheus/prometheus/releases/tag/v2.13.0
2019-10-07 03:22:20 +02:00
* Update Prometheus from v2.12.0 to [v2.13.0](https://github.com/prometheus/prometheus/releases/tag/v2.13.0)
* Fix Prometheus etcd target discovery and scraping ([#561](https://github.com/poseidon/typhoon/pull/561), regressed with Kubernetes v1.16.0)
Update kube-state-metrics from v1.7.2 to v1.8.0 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.8.0
2019-10-02 05:50:33 +02:00
* Update kube-state-metrics from v1.7.2 to v1.8.0
Add stricter types to Azure modules * Review variables available in Azure kubernetes and workers modules and sync with documentation * Fix internal workers module default type to Standard_DS1_v2
2019-10-01 07:18:15 +02:00
* Update nginx-ingress from v0.25.1 to [v0.26.1](https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.26.1) ([#555](https://github.com/poseidon/typhoon/pull/555))
Update nginx-ingress from v0.25.1 to v0.26.1 * Add lifecycle hook to allow draining connections for up to 5 minutes
2019-09-29 20:56:31 +02:00
* Add lifecycle hook to allow draining for up to 5 minutes
Update Grafana from v6.3.6 to v6.4.1 * https://github.com/grafana/grafana/releases/tag/v6.4.1
2019-10-02 05:51:58 +02:00
* Update Grafana from v6.3.5 to [v6.4.1](https://github.com/grafana/grafana/releases/tag/v6.4.1)
Update etcd from v3.4.0 to v3.4.1 * https://github.com/etcd-io/etcd/releases/tag/v3.4.1
2019-09-29 00:09:57 +02:00
Update Kubernetes from v1.15.3 to v1.16.0 * Drop `node-role.kubernetes.io/master` and `node-role.kubernetes.io/node` node labels * Kubelet (v1.16) now rejects the node labels used in the kubectl get nodes ROLES output * https://github.com/kubernetes/kubernetes/issues/75457
2019-09-18 06:24:30 +02:00
## v1.16.0
* Kubernetes [v1.16.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.16.md#v1160) ([#543](https://github.com/poseidon/typhoon/pull/543))
* Read about several Kubernetes API [deprecations](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.16.md#deprecations-and-removals)!
Update CHANGES and docs for v1.16.0 release
2019-09-23 02:37:23 +02:00
* Remove legacy node role labels (no longer shown in `kubectl get nodes`)
* Rename node labels to `node.kubernetes.io/master` and `node.kubernetes.io/node` (migratory)
Update CHANGES for control plane static pod switch * Remove old references to bootkube / self-hosted
2019-09-07 22:38:51 +02:00
* Migrate control plane from self-hosted to static pods ([#536](https://github.com/poseidon/typhoon/pull/536))
* Run `kube-apiserver`, `kube-scheduler`, and `kube-controller-manager` as static pods on each controller
* `kubectl` edits to `kube-apiserver`, `kube-scheduler`, and `kube-controller-manager` are no longer possible (change)
Update Kubernetes from v1.15.3 to v1.16.0 * Drop `node-role.kubernetes.io/master` and `node-role.kubernetes.io/node` node labels * Kubelet (v1.16) now rejects the node labels used in the kubectl get nodes ROLES output * https://github.com/kubernetes/kubernetes/issues/75457
2019-09-18 06:24:30 +02:00
* Remove bootkube, self-hosted pivot, and `pod-checkpointer`
Update CoreDNS from v1.5.0 to v1.6.2 * https://coredns.io/2019/06/26/coredns-1.5.1-release/ * https://coredns.io/2019/07/03/coredns-1.5.2-release/ * https://coredns.io/2019/07/28/coredns-1.6.0-release/ * https://coredns.io/2019/08/02/coredns-1.6.1-release/ * https://coredns.io/2019/08/13/coredns-1.6.2-release/
2019-09-01 00:24:10 +02:00
* Update CoreDNS from v1.5.0 to v1.6.2 ([#535](https://github.com/poseidon/typhoon/pull/535))
Update etcd from v3.3.15 to v3.4.0 * https://github.com/etcd-io/etcd/releases/tag/v3.4.0
2019-09-08 21:57:40 +02:00
* Update etcd from v3.3.15 to [v3.4.0](https://github.com/etcd-io/etcd/releases/tag/v3.4.0)
Recommend updating terraform-provider-ct from v0.3.2 to v0.4.0 * v0.4.0 adds a "strict" mode we'll start using in future and also adds support for Fedora CoreOS * https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.4.0
2019-09-01 01:07:22 +02:00
* Recommend updating `terraform-provider-ct` plugin from v0.3.2 to [v0.4.0](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.4.0)
Update CoreDNS from v1.5.0 to v1.6.2 * https://coredns.io/2019/06/26/coredns-1.5.1-release/ * https://coredns.io/2019/07/03/coredns-1.5.2-release/ * https://coredns.io/2019/07/28/coredns-1.6.0-release/ * https://coredns.io/2019/08/02/coredns-1.6.1-release/ * https://coredns.io/2019/08/13/coredns-1.6.2-release/
2019-09-01 00:24:10 +02:00
Change Azure default controller_type and worker_type * Change default controller_type to Standard_B2s. A B2s is cheaper by $17/month and provides 2 vCPU, 4GB RAM (vs 1 vCPU, 3.5GB RAM) * Change default worker_type to Standard_DS1_v2. F1 was the previous generation. The DS1_v2 is newer, similar cost, more memory, and still supports Low Priority mode, if desired
2019-09-10 07:24:10 +02:00
#### Azure
* Change default `controller_type` to `Standard_B2s` ([#539](https://github.com/poseidon/typhoon/pull/539))
* `B2s` is cheaper by $17/month and provides 2 vCPU, 4GB RAM
* Change default `worker_type` to `Standard_DS1_v2` ([#539](https://github.com/poseidon/typhoon/pull/539))
* `F1` is previous generation. `DS1_v2` is newer, similar cost, and supports Low Priority mode
Update Grafana from v6.3.3 to v6.3.4 * https://github.com/grafana/grafana/releases/tag/v6.3.4
2019-09-01 00:59:13 +02:00
#### Addons
Update Grafana from v6.3.4 to v6.3.5 * https://github.com/grafana/grafana/releases/tag/v6.3.5
2019-09-07 23:21:59 +02:00
* Update Grafana from v6.3.3 to v6.3.5
Update Grafana from v6.3.3 to v6.3.4 * https://github.com/grafana/grafana/releases/tag/v6.3.4
2019-09-01 00:59:13 +02:00
Update Kubernetes from v1.15.2 to v1.15.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md/#v1153
2019-08-19 23:49:24 +02:00
## v1.15.3
* Kubernetes [v1.15.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#v1153)
Update etcd from v3.3.14 to v3.3.15 * No functional changes, just changes to vendoring tools (go modules -> glide). Still, update to v3.3.15 anyway * https://github.com/etcd-io/etcd/compare/v3.3.14...v3.3.15
2019-08-19 23:55:06 +02:00
* Update etcd from v3.3.13 to [v3.3.15](https://github.com/etcd-io/etcd/releases/tag/v3.3.15)
Update Kubernetes from v1.15.2 to v1.15.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md/#v1153
2019-08-19 23:49:24 +02:00
* Update Calico from v3.8.1 to [v3.8.2](https://docs.projectcalico.org/v3.8/release-notes/)
Update Calico from v3.8.1 to v3.8.2 * https://docs.projectcalico.org/v3.8/release-notes/
2019-08-17 00:38:23 +02:00
Enable AWS root block device encryption by default * terraform-provider-aws v2.23.0 allows AWS root block devices to enable encryption by default. * Require updating terraform-provider-aws to v2.23.0 or higher * Enable root EBS device encryption by default for controller instances and worker instances in auto-scaling groups For comparison: * Google Cloud persistent disks have been encrypted by default for years * Azure managed disk encryption is not ready yet (#486)
2019-08-08 05:56:55 +02:00
#### AWS
* Enable root block device encryption by default ([#527](https://github.com/poseidon/typhoon/pull/527))
* Require `terraform-provider-aws` v2.23+ (**action required**)
Update kube-state-metrics from v1.7.1 to v1.7.2 * Add a separate liveness and readiness probe * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2
2019-08-08 04:57:38 +02:00
#### Addons
Update Prometheus from v2.11.2 to v2.12.0 * https://github.com/prometheus/prometheus/releases/tag/v2.12.0
2019-08-19 05:59:44 +02:00
* Update Prometheus from v2.11.0 to [v2.12.0](https://github.com/prometheus/prometheus/releases/tag/v2.12.0)
Update Prometheus from v2.11.0 to v2.11.2 * https://github.com/prometheus/prometheus/releases/tag/v2.11.2
2019-08-15 06:17:02 +02:00
* Update kube-state-metrics from v1.7.1 to v1.7.2
Update Grafana from v6.3.2 to v6.3.3 * https://github.com/grafana/grafana/releases/tag/v6.3.3
2019-08-16 23:40:47 +02:00
* Update Grafana from v6.2.5 to v6.3.3
Update Kubernetes from v1.15.2 to v1.15.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md/#v1153
2019-08-19 23:49:24 +02:00
* Use stable IDs for etcd, CoreDNS, and Nginx Ingress dashboards ([#530](https://github.com/poseidon/typhoon/pull/530))
Update nginx-ingress from v0.25.0 to v0.25.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.25.1
2019-08-15 06:08:31 +02:00
* Update nginx-ingress from v0.25.0 to [v0.25.1](https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.25.1)
* Fix Nginx security advisories
Update kube-state-metrics from v1.7.1 to v1.7.2 * Add a separate liveness and readiness probe * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2
2019-08-08 04:57:38 +02:00
Add CHANGES section for v1.15.2 release
2019-08-06 18:01:22 +02:00
## v1.15.2
Update Kubernetes from v1.15.1 to v1.15.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#v1152
2019-08-05 17:47:39 +02:00
* Kubernetes [v1.15.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#v1152)
Update Calico from v3.8.0 to v3.8.1 * https://docs.projectcalico.org/v3.8/release-notes/
2019-07-28 00:31:13 +02:00
* Update Calico from v3.8.0 to [v3.8.1](https://docs.projectcalico.org/v3.8/release-notes/)
Add Grafana dashboards for CoreDNS and Nginx Ingress Controller * Add a CoreDNS dashboard originally based on an upstream dashboard, but now customized according to preferences * Add an Nginx Ingress Controller based on an upstream dashboard, but customized according to preferences
2019-08-06 07:45:47 +02:00
* Publish new load balancing, TCP/UDP, and firewall [docs](https://typhoon.psdn.io/architecture/aws/) ([#523](https://github.com/poseidon/typhoon/pull/523))
#### Addons
* Add new Grafana dashboards for CoreDNS and Nginx Ingress Controller ([#525](https://github.com/poseidon/typhoon/pull/525))
Update Calico from v3.8.0 to v3.8.1 * https://docs.projectcalico.org/v3.8/release-notes/
2019-07-28 00:31:13 +02:00
Update CHANGES for v1.15.1 release
2019-07-21 20:58:56 +02:00
## v1.15.1
Update Kubernetes from v1.15.0 to v1.15.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#downloads-for-v1151
2019-07-19 10:15:15 +02:00
* Kubernetes [v1.15.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#v1151)
Upgrade Calico from v3.7.4 to v3.8.0 * Enable CNI bandwidth plugin for traffic shaping * https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#support-traffic-shaping
2019-07-12 06:00:03 +02:00
* Upgrade Calico from v3.7.3 to [v3.8.0](https://docs.projectcalico.org/v3.8/release-notes/)
* Enable CNI `bandwidth` plugin for [traffic shaping](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#support-traffic-shaping)
Run kube-apiserver with lower privilege user (nobody) * Run kube-apiserver as a non-root user (nobody). User no longer needs to bind low number ports. * On most platforms, the kube-apiserver load balancer listens on 6443 and fronts controllers with kube-apiserver pods using port 6443. Google Cloud TCP proxy load balancers cannot listen on 6443. However, GCP's load balancer can be made to listen on 443, while kube-apiserver uses 6443 across all platforms.
2019-07-06 22:11:37 +02:00
* Run `kube-apiserver` with lower privilege user (nobody) ([#506](https://github.com/poseidon/typhoon/pull/506))
Relax terraform-provider-ct version constraint * Allow updating terraform-provider-ct to any release beyond v0.3.2, but below v1.0. This relaxes the prior constraint that allowed only v0.3.y provider versions
2019-07-17 07:04:00 +02:00
* Relax `terraform-provider-ct` version constraint (v0.3.2+)
* Allow provider versions below v1.0.0 (e.g. upgrading to v0.4)
Update Calico from v3.7.3 to v3.7.4 * https://docs.projectcalico.org/v3.7/release-notes/
2019-07-03 05:18:02 +02:00
Fix to add all Azure controller nodes to address pool * Add all Azure controllers to the apiserver load balancer backend address pool * Previously, kube-apiserver availability relied on the 0th controller being up. Multi-controller was just providing etcd data redundancy
2019-07-21 19:32:58 +02:00
#### Azure
* Fix to add all controller nodes to the apiserver load balancer backend address pool ([#518](https://github.com/poseidon/typhoon/pull/518))
* kube-apiserver availability relied on the 0th controller
Improve apiserver backend service zone spanning * google_compute_backend_services use nested blocks to define backends (instance groups heterogeneous controllers) * Use Terraform v0.12.x dynamic blocks so the apiserver backend service can refer to (up to zone-many) controller instance groups * Previously, with Terraform v0.11.x, the apiserver backend service had to list a fixed set of backends to span controller nodes across zones in multi-controller setups. 3 backends were used because each GCP region offered at least 3 zones. Single-controller clusters had the cosmetic ugliness of unused instance groups * Allow controllers to span more than 3 zones if avilable in a region (e.g. currently only us-central1, with 4 zones) Related: * https://www.terraform.io/docs/providers/google/r/compute_backend_service.html * https://www.terraform.io/docs/configuration/expressions.html#dynamic-blocks
2019-07-06 04:21:05 +02:00
#### Google Cloud
* Allow controller nodes to span more than 3 zones if available in a region ([#504](https://github.com/poseidon/typhoon/pull/504))
* Eliminate extraneous controller instance groups in single-controller clusters ([#504](https://github.com/poseidon/typhoon/pull/504))
Raise GCP network deletion timeout from 4m to 6m * Fix a GCP errata item https://github.com/poseidon/typhoon/wiki/Errata * Removal of a Google Cloud cluster often required 2 runs of `terraform apply` because network resource deletes timeout after 4m. Raise the network deletion timeout to 6m to ensure apply only needs to be run once to remove a cluster
2019-07-06 04:48:49 +02:00
* Raise network deletion timeout from 4m to 6m ([#505](https://github.com/poseidon/typhoon/pull/505))
Improve apiserver backend service zone spanning * google_compute_backend_services use nested blocks to define backends (instance groups heterogeneous controllers) * Use Terraform v0.12.x dynamic blocks so the apiserver backend service can refer to (up to zone-many) controller instance groups * Previously, with Terraform v0.11.x, the apiserver backend service had to list a fixed set of backends to span controller nodes across zones in multi-controller setups. 3 backends were used because each GCP region offered at least 3 zones. Single-controller clusters had the cosmetic ugliness of unused instance groups * Allow controllers to span more than 3 zones if avilable in a region (e.g. currently only us-central1, with 4 zones) Related: * https://www.terraform.io/docs/providers/google/r/compute_backend_service.html * https://www.terraform.io/docs/configuration/expressions.html#dynamic-blocks
2019-07-06 04:21:05 +02:00
Update Grafana from v6.2.4 to v6.2.5 * https://github.com/grafana/grafana/releases/tag/v6.2.5
2019-06-29 22:17:27 +02:00
#### Addons
Update Prometheus from v2.11.0-rc.0 to v2.11.0 * https://github.com/prometheus/prometheus/releases/tag/v2.11.0
2019-07-10 05:54:57 +02:00
* Update Prometheus from v2.10.0 to v2.11.0
Refresh Prometheus rules/alerts and Grafana dashboards * Refresh rules, alerts, and dashboards from upstreams
2019-07-21 20:02:18 +02:00
* Refresh rules, alerts, and dashboards from upstreams
Update kube-state-metrics from v1.7.0 to v1.7.1 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.1
2019-07-21 05:17:08 +02:00
* Update kube-state-metrics from v1.6.0 to v1.7.1
Update Grafana from v6.2.4 to v6.2.5 * https://github.com/grafana/grafana/releases/tag/v6.2.5
2019-06-29 22:17:27 +02:00
* Update Grafana from v6.2.4 to v6.2.5
Upgrade nginx-ingress from v0.24.1 to v0.25.0 * Support networking.k8s.io/v1beta1 apiVersion * Update RBAC cluster-role for networking.k8s.io/v1beta1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.25.0
2019-07-09 07:04:50 +02:00
* Update nginx-ingress from v0.24.1 to v0.25.0
* Support `networking.k8s.io/v1beta1` apiVersion
Update Grafana from v6.2.4 to v6.2.5 * https://github.com/grafana/grafana/releases/tag/v6.2.5
2019-06-29 22:17:27 +02:00
Update Kubernetes from v1.14.3 to v1.15.0 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#v1150 * Remove docs referring to possible v1.14.4 release
2019-06-20 06:29:43 +02:00
## v1.15.0
* Kubernetes [v1.15.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#v1150)
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
* Migrate from Terraform v0.11 to v0.12.x (**action required!**)
Add migration instructions from Terraform v0.11 to v0.12 * Provide Terraform v0.11 to v0.12 migration guide. Show an in-place strategy and a move resources strategy * Describe in-place modifying an existing cluster and providers, using the Terraform helper to edit syntax, and checking the plan produces a zero diff * Describe replacing existing clusters by creating a new config directory for use with Terraform v0.12 only and moving resources one by one * Provide some limited advise on migrating non-Typhoon resources
2019-05-31 09:27:25 +02:00
* [Migration](https://typhoon.psdn.io/topics/maintenance/#terraform-v012x) instructions for Terraform v0.12
* Require `terraform-provider-ct` v0.3.2+ to support Terraform v0.12 (action required)
Update Calico from v3.7.2 to v3.7.3 * https://docs.projectcalico.org/v3.7/release-notes/
2019-06-14 08:54:20 +02:00
* Update Calico from v3.7.2 to [v3.7.3](https://docs.projectcalico.org/v3.7/release-notes/)
Remove Fedora Atomic modules * Typhoon for Fedora Atomic was deprecated in March 2019 * https://typhoon.psdn.io/announce/#march-27-2019
2019-06-23 22:38:49 +02:00
* Remove Fedora Atomic modules (deprecated in March) ([#501](https://github.com/poseidon/typhoon/pull/501))
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
#### AWS
* Require `terraform-provider-aws` v2.7+ to support Terraform v0.12 (action required)
Allow using Flatcar Linux Edge on bare-metal and AWS * On AWS, use Flatcar Linux Edge by setting `os_image` to "flatcar-edge" * On bare-metal, Flatcar Linux Edge by setting `os_channel` to "flatcar-edge"
2019-06-12 07:13:41 +02:00
* Allow using Flatcar Linux Edge by setting `os_image` to "flatcar-edge"
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
#### Azure
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
* Require `terraform-provider-azurerm` v1.27+ to support Terraform v0.12 (action required)
Avoid unneeded rotations of Regular priority virtual machine scale sets * Azure only allows `eviction_policy` to be set for Low priority VMs. Supporting Low priority VMs meant when Regular VMs were used, each `terraform apply` rolled workers, to set eviction_policy to null. * Terraform v0.12 nullable variables fix the issue and plan does not produce a diff
2019-05-28 07:55:16 +02:00
* Avoid unneeded rotations of Regular priority virtual machine scale sets
* Azure only allows `eviction_policy` to be set for Low priority VMs. Supporting Low priority VMs meant when Regular VMs were used, each `terraform apply` rolled workers, to set eviction_policy to null.
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
* Terraform v0.12 nullable variables fix the issue so plan does not produce a diff.
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
#### Bare-Metal
* Require `terraform-provider-matchbox` v0.3.0+ to support Terraform v0.12 (action required)
Allow using Flatcar Linux Edge on bare-metal and AWS * On AWS, use Flatcar Linux Edge by setting `os_image` to "flatcar-edge" * On bare-metal, Flatcar Linux Edge by setting `os_channel` to "flatcar-edge"
2019-06-12 07:13:41 +02:00
* Allow using Flatcar Linux Edge by setting `os_channel` to "flatcar-edge"
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
Migrate DigitalOcean module from Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update DigitalOcean tutorial documentation * Define Terraform and plugin version requirements in versions.tf * Require digitalocean ~> v1.3 to support Terraform v0.12 * Require ct ~> v0.3.2 to support Terraform v0.12
2019-05-28 00:37:36 +02:00
#### DigitalOcean
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
* Require `terraform-provider-digitalocean` v1.3+ to support Terraform v0.12 (action required)
Change DO worker_type default from s-1vcpu-1gb to s-1vcpu-2gb * On DigitalOcean, `s-1vcpu-1gb` worker nodes have 1GB of RAM, which is too small as a default, even for most cost constrained developers
2019-06-01 22:49:56 +02:00
* Change the default `worker_type` from `s-1vcpu1-1gb` to `s-1vcpu-2gb`
Migrate DigitalOcean module from Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update DigitalOcean tutorial documentation * Define Terraform and plugin version requirements in versions.tf * Require digitalocean ~> v1.3 to support Terraform v0.12 * Require ct ~> v0.3.2 to support Terraform v0.12
2019-05-28 00:37:36 +02:00
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
#### Google Cloud
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
* Require `terraform-provider-google` v2.5+ to support Terraform v0.12 (action required)
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
Update Grafana from v6.2.1 to v6.2.2 * https://github.com/grafana/grafana/releases/tag/v6.2.2
2019-06-07 09:07:54 +02:00
#### Addons
Update Grafana from v6.2.2 to v6.2.4 * https://github.com/grafana/grafana/releases/tag/v6.2.4
2019-06-20 06:51:54 +02:00
* Update Grafana from v6.2.1 to v6.2.4
Update node-exporter from v0.18.0 to v0.18.1 * https://github.com/prometheus/node_exporter/releases/tag/v0.18.1
2019-06-07 11:08:28 +02:00
* Update node-exporter from v0.18.0 to v0.18.1
Update Grafana from v6.2.1 to v6.2.2 * https://github.com/grafana/grafana/releases/tag/v6.2.2
2019-06-07 09:07:54 +02:00
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
## v1.14.3
Bump Terraform provider versions in docs * Bump Terraform provider versions to reflect the versions used by the maintainer
2019-05-20 18:29:56 +02:00
Update Kubernetes from v1.14.2 to v1.14.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1143
2019-05-31 10:08:32 +02:00
* Kubernetes [v1.14.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1143)
Update CoreDNS from v1.3.1 to v1.5.0 * Add `ready` plugin to improve readinessProbe * https://coredns.io/2019/04/06/coredns-1.5.0-release/
2019-05-27 09:11:52 +02:00
* Update CoreDNS from v1.3.1 to v1.5.0
* Add `ready` plugin to improve readinessProbe
Fix terraform-render-bootkube to remove trailing slash * Fix to remove a trailing slash that was erroneously introduced in the scripting that updated from v1.14.1 to v1.14.2 * Workaround before this fix was to re-run `terraform init`
2019-05-22 18:24:42 +02:00
* Fix trailing slash in terraform-render-bootkube version ([#479](https://github.com/poseidon/typhoon/pull/479))
Recommend updating Terraform providers ct and matchbox * Recomment updating Terraform provider plugins `terraform-provider-ct` and `terraform-provider-matchbox` to prepare for the upcoming Terraform v0.12 migration * https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.3.2 * https://github.com/poseidon/terraform-provider-matchbox/releases/tag/v0.3.0
2019-05-31 09:45:16 +02:00
* Recommend updating `terraform-provider-ct` plugin from v0.3.1 to [v0.3.2](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.3.2) ([#487](https://github.com/poseidon/typhoon/pull/487))
Fix terraform-render-bootkube to remove trailing slash * Fix to remove a trailing slash that was erroneously introduced in the scripting that updated from v1.14.1 to v1.14.2 * Workaround before this fix was to re-run `terraform init`
2019-05-22 18:24:42 +02:00
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
#### AWS
Rename worker pool modules' count variable to worker_count * This change affects users who use worker pools on AWS, GCP, or Azure with a Container Linux derivative * Rename worker pool modules' `count` variable to `worker_count`, because `count` will be a reserved variable name in Terraform v0.12
2019-05-28 01:33:21 +02:00
* Rename `worker` pool module `count` variable to `worker_count` ([#485](https://github.com/poseidon/typhoon/pull/485)) (action required)
* `count` will become a reserved variable name in Terraform v0.12
Replace deprecated `azurerm_autoscale_setting` * Fix Terraform provider azure warning about `azurerm_autoscale_setting` * Require terraform-provider-azure v1.22+ version that introduces the new `azurerm_monitor_autoscale_setting` resource * https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/CHANGELOG.md#1220-february-11-2019
2019-05-27 08:14:50 +02:00
#### Azure
* Replace `azurerm_autoscale_setting` with `azurerm_monitor_autoscale_setting` ([#482](https://github.com/poseidon/typhoon/pull/482))
Rename worker pool modules' count variable to worker_count * This change affects users who use worker pools on AWS, GCP, or Azure with a Container Linux derivative * Rename worker pool modules' `count` variable to `worker_count`, because `count` will be a reserved variable name in Terraform v0.12
2019-05-28 01:33:21 +02:00
* Rename `worker` pool module `count` variable to `worker_count` ([#485](https://github.com/poseidon/typhoon/pull/485)) (action required)
* `count` will become a reserved variable name in Terraform v0.12
Recommend updating Terraform providers ct and matchbox * Recomment updating Terraform provider plugins `terraform-provider-ct` and `terraform-provider-matchbox` to prepare for the upcoming Terraform v0.12 migration * https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.3.2 * https://github.com/poseidon/terraform-provider-matchbox/releases/tag/v0.3.0
2019-05-31 09:45:16 +02:00
#### Bare-Metal
* Recommend updating `terraform-provider-matchbox` plugin from v0.2.3 to [v0.3.0](https://github.com/poseidon/terraform-provider-matchbox/releases/tag/v0.3.0) ([#487](https://github.com/poseidon/typhoon/pull/487))
#### Google Cloud
Rename worker pool modules' count variable to worker_count * This change affects users who use worker pools on AWS, GCP, or Azure with a Container Linux derivative * Rename worker pool modules' `count` variable to `worker_count`, because `count` will be a reserved variable name in Terraform v0.12
2019-05-28 01:33:21 +02:00
* Rename `worker` pool module `count` variable to `worker_count` ([#485](https://github.com/poseidon/typhoon/pull/485)) (action required)
Migrate Google Cloud module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Google Cloud tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require google ~> 2.5 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:14:25 +02:00
* `count` is a reserved variable in Terraform v0.12
Replace deprecated `azurerm_autoscale_setting` * Fix Terraform provider azure warning about `azurerm_autoscale_setting` * Require terraform-provider-azure v1.22+ version that introduces the new `azurerm_monitor_autoscale_setting` resource * https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/CHANGELOG.md#1220-february-11-2019
2019-05-27 08:14:50 +02:00
Update Prometheus from v2.9.2 to v2.10.0 * https://github.com/prometheus/prometheus/releases/tag/v2.10.0
2019-05-27 06:58:28 +02:00
#### Addons
* Update Prometheus from v2.9.2 to v2.10.0
Update Grafana from v2.6.0 to v2.6.1
2019-05-27 21:25:00 +02:00
* Update Grafana from v6.1.6 to v6.2.1
Update Prometheus from v2.9.2 to v2.10.0 * https://github.com/prometheus/prometheus/releases/tag/v2.10.0
2019-05-27 06:58:28 +02:00
Bump Terraform provider versions in docs * Bump Terraform provider versions to reflect the versions used by the maintainer
2019-05-20 18:29:56 +02:00
## v1.14.2
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
Update Kubernetes from v1.14.1 to v1.14.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1142
2019-05-17 13:09:15 +02:00
* Kubernetes [v1.14.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1142)
Update etcd from v3.3.12 to v3.3.13 on Container Linux * Skip updating etcd for Fedora Atomic clusters, now that Fedora Atomic has been deprecated
2019-05-04 20:42:51 +02:00
* Update etcd from v3.3.12 to [v3.3.13](https://github.com/etcd-io/etcd/releases/tag/v3.3.13)
Update Calico from v3.7.0 to v3.7.2 * https://docs.projectcalico.org/v3.7/release-notes/
2019-05-17 12:29:46 +02:00
* Upgrade Calico from v3.6.1 to [v3.7.2](https://docs.projectcalico.org/v3.7/release-notes/)
Allow Calico networking on Azure and DigitalOcean * Introduce "calico" as a `networking` option on Azure and DigitalOcean using Calico's new VXLAN support (similar to flannel). Flannel remains the default on these platforms for now. * Historically, DigitalOcean and Azure only allowed Flannel as the CNI provider, since those platforms don't support IPIP traffic that was previously required for Calico. * Looking forward, its desireable for Calico to become the default across Typhoon clusters, since it provides NetworkPolicy and a consistent experience * No changes to AWS, GCP, or bare-metal where Calico remains the default CNI provider. On these platforms, IPIP mode will always be used, since its available and more performant than vxlan
2019-05-06 09:38:23 +02:00
* Change flannel VXLAN port from 8472 (kernel default) to 4789 (IANA VXLAN)
Change flannel port from 8472 to 4789 * Change flannel port from the kernel default 8472 to the IANA assigned VXLAN port 4789 * Update firewall rules or security groups for VXLAN * Why now? Calico now offers its own VXLAN backend so standardizing on the IANA port will simplify config * https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan
2019-05-07 06:56:38 +02:00
#### AWS
Allow Calico networking on Azure and DigitalOcean * Introduce "calico" as a `networking` option on Azure and DigitalOcean using Calico's new VXLAN support (similar to flannel). Flannel remains the default on these platforms for now. * Historically, DigitalOcean and Azure only allowed Flannel as the CNI provider, since those platforms don't support IPIP traffic that was previously required for Calico. * Looking forward, its desireable for Calico to become the default across Typhoon clusters, since it provides NetworkPolicy and a consistent experience * No changes to AWS, GCP, or bare-metal where Calico remains the default CNI provider. On these platforms, IPIP mode will always be used, since its available and more performant than vxlan
2019-05-06 09:38:23 +02:00
* Only set internal VXLAN rules when `networking` is "flannel" (default: calico)
#### Azure
* Allow choosing Calico as the network provider (experimental) ([#472](https://github.com/poseidon/typhoon/pull/472))
* Add a `networking` variable accepting "flannel" (default) or "calico"
* Use VXLAN encapsulation since Azure doesn't support IPIP
Remove unofficial bare-metal *_networkds variables * Remove controller_networkds and worker_networkds variables. These variables were always listed as experimental, unsupported, and excluded from documentation in anticipation of Container Linux Config snippets * Use Container Linux Config snippets on bare-metal instead. They provide safer, more powerful, and more elegant host customization
2018-08-13 01:44:13 +02:00
Fix race condition in DigitalOcean cluster create * DigitalOcean clusters must secure copy a kubeconfig to worker nodes, but Terraform could decide to try copying before firewall rules have been added to allow SSH access. * Add an explicit dependency on adding firewall rules first
2019-05-17 12:52:16 +02:00
#### DigitalOcean
Allow Calico networking on Azure and DigitalOcean * Introduce "calico" as a `networking` option on Azure and DigitalOcean using Calico's new VXLAN support (similar to flannel). Flannel remains the default on these platforms for now. * Historically, DigitalOcean and Azure only allowed Flannel as the CNI provider, since those platforms don't support IPIP traffic that was previously required for Calico. * Looking forward, its desireable for Calico to become the default across Typhoon clusters, since it provides NetworkPolicy and a consistent experience * No changes to AWS, GCP, or bare-metal where Calico remains the default CNI provider. On these platforms, IPIP mode will always be used, since its available and more performant than vxlan
2019-05-06 09:38:23 +02:00
* Allow choosing Calico as the network provider (experimental) ([#472](https://github.com/poseidon/typhoon/pull/472))
* Add a `networking` variable accepting "flannel" (default) or "calico"
* Use VXLAN encapsulation since DigitalOcean doesn't support IPIP
Fix race condition in DigitalOcean cluster create * DigitalOcean clusters must secure copy a kubeconfig to worker nodes, but Terraform could decide to try copying before firewall rules have been added to allow SSH access. * Add an explicit dependency on adding firewall rules first
2019-05-17 12:52:16 +02:00
* Add explicit ordering between firewall rule creation and secure copying Kubelet credentials ([#469](https://github.com/poseidon/typhoon/pull/469))
* Fix race scenario if copies to nodes were before rule creation, blocking cluster creation
Update Prometheus from v2.8.1 to v2.9.1 * https://github.com/prometheus/prometheus/releases/tag/v2.9.1 * https://github.com/prometheus/prometheus/releases/tag/v2.9.0
2019-04-19 08:26:32 +02:00
#### Addons
Update Prometheus from v2.9.1 to v2.9.2 * https://github.com/prometheus/prometheus/releases/tag/v2.9.2
2019-04-28 05:39:55 +02:00
* Update Prometheus from v2.8.1 to v2.9.2
Update kube-state-metrics from v1.6.0-rc.2 to v1.6.0 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.6.0
2019-05-07 06:30:49 +02:00
* Update kube-state-metrics from v1.5.0 to v1.6.0
Update node_exporter from v0.17.0 to v0.18.0 * https://github.com/prometheus/node_exporter/releases/tag/v0.18.0
2019-05-17 20:01:30 +02:00
* Update node-exporter from v0.17.0 to v0.18.0
Update Grafana from v6.1.4 to v6.1.6 * https://github.com/grafana/grafana/releases/tag/v6.1.6
2019-05-04 20:14:37 +02:00
* Update Grafana from v6.1.3 to v6.1.6
Update etcd from v3.3.12 to v3.3.13 on Container Linux * Skip updating etcd for Fedora Atomic clusters, now that Fedora Atomic has been deprecated
2019-05-04 20:42:51 +02:00
* Reduce nginx-ingress Role RBAC permissions ([#458](https://github.com/poseidon/typhoon/pull/458))
Update Prometheus from v2.8.1 to v2.9.1 * https://github.com/prometheus/prometheus/releases/tag/v2.9.1 * https://github.com/prometheus/prometheus/releases/tag/v2.9.0
2019-04-19 08:26:32 +02:00
Update provider versions in tutorial docs * Update terraform provider plugin version in docs to reflect the recommended current versions that are currently used
2019-04-16 09:05:13 +02:00
## v1.14.1
Update Kubernetes from v1.14.0 to v1.14.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#changelog-since-v1140
2019-04-10 06:47:23 +02:00
* Kubernetes [v1.14.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1141)
Update Grafana from v6.1.1 to v6.1.3 * https://github.com/grafana/grafana/releases/tag/v6.1.3
2019-04-10 07:06:27 +02:00
#### Addons
* Update Grafana from v6.1.1 to v6.1.3
Update nginx-ingress from v0.23.0 to v0.24.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.24.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.24.0
2019-04-16 06:07:12 +02:00
* Update nginx-ingress from v0.23.0 to v0.24.1
Revert "Update kube-state-metrics from v1.5.0 to v1.6.0-rc.0" * This reverts commit 6e5d66cf666a2700ad3e540698a6e243651b96d9 * kube-state-metrics v1.6.0-rc.0 fires KubeDeploymentReplicasMismatch alerts where its own Deployment doesn't have replicas available, (kube_deployment_status_replicas_available) even though all replicas are available according to kubectl inspection * This problem was present even with the CSR ClusterRole fix (https://github.com/kubernetes/kube-state-metrics/pull/717)
2019-04-13 21:37:53 +02:00
Update CHANGES for v1.14.0 release
2019-04-09 03:48:49 +02:00
## v1.14.0
Update Kubernetes from v1.13.5 to v1.14.0 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1140
2019-04-07 09:09:00 +02:00
* Kubernetes [v1.14.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1140)
Update Calico from v3.6.0 to v3.6.1 * https://docs.projectcalico.org/v3.6/release-notes/
2019-04-01 02:43:43 +02:00
* Update Calico from v3.6.0 to v3.6.1
Add ability to load balance TCP/UDP applications on Azure * Add ability to load balance TCP/UDP applications (e.g. NodePort) * Output the load balancer ID as `loadbalancer_id` * Output `worker_security_group_name` and `worker_address_prefix` for extending firewall rules
2019-04-08 03:04:02 +02:00
* Add `enable_aggregation` option for CNCF conformance ([#436](https://github.com/poseidon/typhoon/pull/436))
Add enable_aggregation option (defaults to false) * Add an `enable_aggregation` variable to enable the kube-apiserver aggregation layer for adding extension apiservers to clusters * Aggregation is **disabled** by default. Typhoon recommends you not enable aggregation. Consider whether less invasive ways to achieve your goals are possible and whether those goals are well-founded * Enabling aggregation and extension apiservers increases the attack surface of a cluster and makes extensions a part of the control plane. Admins must scrutinize and trust any extension apiserver used. * Passing a v1.14 CNCF conformance test requires aggregation be enabled. Having an option for aggregation keeps compliance, but retains the stricter security posture on default clusters
2019-04-07 11:29:07 +02:00
* Aggregation is disabled by default to retain our security stance
* Aggregation increases the security surface area. Extensions become part of the control plane and must be scrutinized carefully and trusted. Favor leaving aggregation disabled.
Update Calico from v3.6.0 to v3.6.1 * https://docs.projectcalico.org/v3.6/release-notes/
2019-04-01 02:43:43 +02:00
Add ability to load balance TCP applications on AWS * Add ability to load balance TCP applications (e.g. NodePort) * Output the network load balancer ARN as `nlb_id` * Accept a `worker_target_groups` (ARN) list to which worker instances should be added * AWS NLBs and target groups don't support UDP
2019-04-01 08:22:47 +02:00
#### AWS
* Add ability to load balance TCP applications ([#443](https://github.com/poseidon/typhoon/pull/443))
* Output the network load balancer ARN as `nlb_id`
* Accept a `worker_target_groups` (ARN) list to which worker instances should be added
Add ability to load balance TCP/UDP applications on Azure * Add ability to load balance TCP/UDP applications (e.g. NodePort) * Output the load balancer ID as `loadbalancer_id` * Output `worker_security_group_name` and `worker_address_prefix` for extending firewall rules
2019-04-08 03:04:02 +02:00
#### Azure
* Add ability to load balance TCP/UDP applications ([#447](https://github.com/poseidon/typhoon/pull/447))
* Output the load balancer ID as `loadbalancer_id`
* Output `worker_security_group_name` and `worker_address_prefix` for extending firewall rules ([#447](https://github.com/poseidon/typhoon/pull/447))
Harden internal firewall rules on DigitalOcean * Define firewall rules on DigitialOcean to match rules used on AWS, GCP, and Azure * Output `controller_tag` and `worker_tag` to simplify custom firewall rule creation
2019-04-03 08:02:04 +02:00
#### DigitalOcean
Add ability to load balance TCP/UDP applications on Azure * Add ability to load balance TCP/UDP applications (e.g. NodePort) * Output the load balancer ID as `loadbalancer_id` * Output `worker_security_group_name` and `worker_address_prefix` for extending firewall rules
2019-04-08 03:04:02 +02:00
* Harden internal (node-to-node) firewall rules to align with other platforms ([#444](https://github.com/poseidon/typhoon/pull/444))
Update CHANGES for v1.14.0 release
2019-04-09 03:48:49 +02:00
* Add ability to load balance TCP applications ([#444](https://github.com/poseidon/typhoon/pull/444))
* Output `controller_tag` and `worker_tag` for extending firewall rules ([#444](https://github.com/poseidon/typhoon/pull/444))
Harden internal firewall rules on DigitalOcean * Define firewall rules on DigitialOcean to match rules used on AWS, GCP, and Azure * Output `controller_tag` and `worker_tag` to simplify custom firewall rule creation
2019-04-03 08:02:04 +02:00
Remove Haswell minimum CPU platform requirement * Google Cloud API implements `min_cpu_platform` to mean "use exactly this CPU" * Fix error creating clusters in newer regions lacking Haswell platform (e.g. europe-west2) (#438) * Reverts #405, added in v1.13.4 * Original goal of ignoring old Ivy/Sandy bridge CPUs in older regions will be achieved shortly anyway. Google Cloud is deprecating those CPUs in April 2019 * https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform#how_selecting_a_minimum_cpu_platform_works
2019-03-28 03:45:10 +01:00
#### Google Cloud
Add Google Cloud worker instances to a target pool * Background: A managed instance group of workers is used in backend services for global load balancing (HTTP/HTTPS Ingress) and output for custom global load balancing use cases * Add worker instances to a target pool load balancing TCP/UDP applications (NodePort or proxied). Output as `worker_target_pool` * Health check for workers with a healthy Ingress controller. Forward rules (regional) to target pools don't support different external and internal ports so choosing nodes with Ingress allows proxying as a workaround * A target pool is a logical grouping only. It doesn't add costs to clusters or worker pools
2019-03-30 23:12:55 +01:00
* Add ability to load balance TCP/UDP applications ([#442](https://github.com/poseidon/typhoon/pull/442))
* Add worker instances to a target pool, output as `worker_target_pool`
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
* Health check for workers with Ingress controllers. Forward rules don't support differing internal/external ports, but some Ingress controllers support TCP/UDP proxy as a workaround
Remove Haswell minimum CPU platform requirement * Google Cloud API implements `min_cpu_platform` to mean "use exactly this CPU" * Fix error creating clusters in newer regions lacking Haswell platform (e.g. europe-west2) (#438) * Reverts #405, added in v1.13.4 * Original goal of ignoring old Ivy/Sandy bridge CPUs in older regions will be achieved shortly anyway. Google Cloud is deprecating those CPUs in April 2019 * https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform#how_selecting_a_minimum_cpu_platform_works
2019-03-28 03:45:10 +01:00
* Remove Haswell minimum CPU platform requirement ([#439](https://github.com/poseidon/typhoon/pull/439))
* Google Cloud API implements `min_cpu_platform` to mean "use exactly this CPU". Revert [#405](https://github.com/poseidon/typhoon/pull/405) added in v1.13.4.
* Fix error creating clusters in new regions without Haswell (e.g. europe-west2) ([#438](https://github.com/poseidon/typhoon/issues/438))
Update Prometheus from v2.8.0 to v2.8.1 * https://github.com/prometheus/prometheus/releases/tag/v2.8.1
2019-04-01 02:03:22 +02:00
#### Addons
* Update Prometheus from v2.8.0 to v2.8.1
Update Grafana from v6.1.0 to v6.1.1
2019-04-07 03:31:43 +02:00
* Update Grafana from v6.0.2 to [v6.1.1](http://docs.grafana.org/guides/whats-new-in-v6-1/)
Refresh Prometheus rules and Grafana dashboards * Refresh rules and dashboards from upstreams * Add new Kubernetes "workload" dashboards * View pods in a workload (deployment/daemonset/statefulset) * View workloads in a namespace
2019-04-07 08:27:11 +02:00
* Add dashboard for pods in a workload (deployment/daemonset/statefulset) ([#446](https://github.com/poseidon/typhoon/pull/446))
* Add dashboard for workloads by namespace
Update Prometheus from v2.8.0 to v2.8.1 * https://github.com/prometheus/prometheus/releases/tag/v2.8.1
2019-04-01 02:03:22 +02:00
Update Kubernetes from v1.13.4 to v1.13.5 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1135
2019-03-26 05:43:47 +01:00
## v1.13.5
* Kubernetes [v1.13.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1135)
Resolve in-addr.arpa and ip6.arpa zones with CoreDNS kubernetes plugin * Resolve in-addr.arpa and ip6.arpa DNS PTR requests for Kubernetes service IPs and pod IPs * Previously, CoreDNS was configured to resolve in-addr.arpa PTR records for service IPs (but not pod IPs)
2019-03-05 08:00:13 +01:00
* Resolve in-addr.arpa reverse DNS lookups (PTR) for pod IPv4 addresses ([#415](https://github.com/poseidon/typhoon/pull/415))
* Reverse DNS lookups for service IPv4 addresses unchanged
Update Calico from v3.5.2 to v3.6.0 * Add calico-ipam CRDs and RBAC permissions * Switch IPAM from host-local to calico-ipam * `calico-ipam` subnets `ippools` (defaults to pod CIDR) into `ipamblocks` (defaults to /26, but set to /24 in Typhoon) * `host-local` subnets the pod CIDR based on the node PodCIDR field (set via kube-controller-manager as /24's) * Create a custom default IPv4 IPPool to ensure the block size is kept at /24 to allow 110 pods per node (Kubernetes default) * Retaining host-local was slightly preferred, but Calico v3.6 is migrating all usage to calico-ipam. The codepath that skipped calico-ipam for KDD was removed * https://docs.projectcalico.org/v3.6/release-notes/
2019-03-19 05:07:07 +01:00
* Upgrade Calico from v3.5.2 to [v3.6.0](https://docs.projectcalico.org/v3.6/release-notes/) ([#430](https://github.com/poseidon/typhoon/pull/430))
* Change pod IPAM from `host-local` to `calico-ipam`. `pod_cidr` is still divided into `/24` subnets per node, but managed as `ippools` and `ipamblocks`
Recommend updating Terraform providers ct and matchbox * Recomment updating Terraform provider plugins `terraform-provider-ct` and `terraform-provider-matchbox` to prepare for the upcoming Terraform v0.12 migration * https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.3.2 * https://github.com/poseidon/terraform-provider-matchbox/releases/tag/v0.3.0
2019-05-31 09:45:16 +02:00
* Recommend updating [terraform-provider-ct](https://github.com/poseidon/terraform-provider-ct) from v0.3.0 to [v0.3.1](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.3.1) ([#434](https://github.com/poseidon/typhoon/pull/434))
Announce Fedora Atomic modules won't be updated beyond v1.13.x * Thank you Project Atomic team and users * See the deprecation announcement https://typhoon.psdn.io/announce/#march-27-2019
2019-03-27 07:47:14 +01:00
* Announce: Fedora Atomic modules will be not be updated beyond Kubernetes v1.13.x ([#437](https://github.com/poseidon/typhoon/pull/437))
* Thank you Project Atomic team and users, please see the deprecation [notice](https://typhoon.psdn.io/announce/#march-27-2019)
Resolve in-addr.arpa and ip6.arpa zones with CoreDNS kubernetes plugin * Resolve in-addr.arpa and ip6.arpa DNS PTR requests for Kubernetes service IPs and pod IPs * Previously, CoreDNS was configured to resolve in-addr.arpa PTR records for service IPs (but not pod IPs)
2019-03-05 08:00:13 +01:00
Add support for terraform-provider-aws v2.0+ * Allow terraform-provider-aws >= v1.13, but < 3.0. No change to the minimum version, but allow using v2.x.y releases * Verify compatability with terraform-provider-aws v2.1.0
2019-03-09 21:03:10 +01:00
#### AWS
* Support `terraform-provider-aws` v2.0+ ([#419](https://github.com/poseidon/typhoon/pull/419))
Change default iPXE kernel/initrd download from HTTP to HTTPS * Require an iPXE-enabled network boot environment with support for TLS downloads. PXE clients must chainload to iPXE firmware compiled with `DOWNLOAD_PROTO_HTTPS` enabled ([crypto](https://ipxe.org/crypto)) * iPXE's pre-compiled firmware binaries do _not_ enable HTTPS. Admins should build iPXE from source with support enabled * Affects the Container Linux and Flatcar Linux install profiles that pull from public downloads. No effect when cached_install=true or using Fedora Atomic, as those download from Matchbox * Add `download_protocol` variable. Recognizing boot firmware TLS support is difficult in some environments, set the protocol to "http" for the old behavior (discouraged)
2019-03-10 04:34:15 +01:00
#### Bare-Metal
* Change the default iPXE kernel and initrd download protocol from HTTP to HTTPS ([#420](https://github.com/poseidon/typhoon/pull/420))
* Require an iPXE-enabled network boot environment with support for TLS downloads. PXE clients must chainload to iPXE firmware compiled with `DOWNLOAD_PROTO_HTTPS` [enabled](https://ipxe.org/crypto). (**action required**)
Update mkdocs and plugin versions used in tutorials * Recommend provider plugin versions that are currently used by the author * Recommend updating terraform-provider-ct plugin from v0.3.0 to v0.3.1 * https://github.com/coreos/terraform-provider-ct/releases
2019-03-26 08:46:11 +01:00
* Only affects Container Linux and Flatcar Linux install profiles that pull public images (default)
Change default iPXE kernel/initrd download from HTTP to HTTPS * Require an iPXE-enabled network boot environment with support for TLS downloads. PXE clients must chainload to iPXE firmware compiled with `DOWNLOAD_PROTO_HTTPS` enabled ([crypto](https://ipxe.org/crypto)) * iPXE's pre-compiled firmware binaries do _not_ enable HTTPS. Admins should build iPXE from source with support enabled * Affects the Container Linux and Flatcar Linux install profiles that pull from public downloads. No effect when cached_install=true or using Fedora Atomic, as those download from Matchbox * Add `download_protocol` variable. Recognizing boot firmware TLS support is difficult in some environments, set the protocol to "http" for the old behavior (discouraged)
2019-03-10 04:34:15 +01:00
* Add `download_protocol` variable. Recognizing boot firmware TLS support is difficult in some environments, set the protocol to "http" for the old behavior (discouraged)
Re-add Kubelet metadata service dependency on DigitalOcean * Restore the original special-casing of DigitalOcean Kubelets * Fix node metadata InternalIP being set to the IP of the default gateway on DigitalOcean nodes (regressed in v1.12.3) * Reverts the "pretty" node names on DigitalOcean (worker-2 vs IP) * Closes #424 (full details)
2019-03-14 08:55:55 +01:00
#### DigitalOcean
* Fix kubelet hostname-override to set node metadata InternalIP correctly ([#424](https://github.com/poseidon/typhoon/issues/424))
* Uniquely, DigitalOcean does not resolve hostnames to instance private IPs. Kubelet auto-detect mechanisms require the internal IP be set directly.
* Regressed in v1.12.3 ([#337](https://github.com/poseidon/typhoon/pull/337)) which aimed to provide friendly hostname-based node names on DigitalOcean
Update Prometheus from v2.7.1 to v2.7.2 * https://github.com/prometheus/prometheus/releases/tag/v2.7.2
2019-03-05 08:08:12 +01:00
#### Addons
Update Prometheus from v2.7.2 to v2.8.0 * https://github.com/prometheus/prometheus/releases/tag/v2.8.0
2019-03-14 06:11:38 +01:00
* Update Prometheus from v2.7.1 to [v2.8.0](https://github.com/prometheus/prometheus/releases/tag/v2.8.0)
Refresh Prometheus rules and Grafana dashboards * Refresh rules and dashboards from upstreams * Organize dashboards and stay below the ConfigMap size limit
2019-03-14 07:05:14 +01:00
* Refresh rules based on upstreams ([#426](https://github.com/poseidon/typhoon/pull/426))
Add NetworkPolicy to limit traffic into Prometheus * Allow traffic from Grafana to Prometheus in monitoring * Allow traffic from Prometheus to Prometheus in monitoring * NetworkPolicy denies non-whitelisted traffic. Define policy to allow other access
2019-03-24 01:59:47 +01:00
* Define NetworkPolicy to allow only traffic from the Grafana addon
Update Grafana from v6.0.1 to v6.0.2 * https://github.com/grafana/grafana/releases/tag/v6.0.2
2019-03-22 07:41:25 +01:00
* Update Grafana from v6.0.0 to v6.0.2
Add liveness and readiness probes to Grafana * https://github.com/grafana/grafana/issues/3302
2019-03-24 01:54:16 +01:00
* Add liveness and readiness probes
Refresh Prometheus rules and Grafana dashboards * Refresh rules and dashboards from upstreams * Organize dashboards and stay below the ConfigMap size limit
2019-03-14 07:05:14 +01:00
* Refresh dashboards and organize to stay below ConfigMap size limit ([#426](https://github.com/poseidon/typhoon/pull/426))
Remove heapster manifests from addons * Heapster addon powers `kubectl top` * In early Kubernetes, people legitimately used and expected `kubectl top` to work, so the optional addon was provided * Today the standards are different. Many better monitoring tools exist, that are also less coupled to Kubernetes "kubectl top" reliance on a non-core extensions means its not in-scope for minimal Kubernetes clusters. No more exceptionalism * Finally, Heapster isn't that useful anymore. Its manifests have no need for Typhoon-specific modification * Look to prior releases if you still wish to apply heapster
2019-03-14 07:46:04 +01:00
* Remove heapster manifests from addons ([#427](https://github.com/poseidon/typhoon/pull/427))
* Heapster addon powers `kubectl top` (in early Kubernetes, running the addon was expected). Today, there are better monitoring options.
* `kubectl top` reliance on a non-core extension means its not in-scope for minimal Kubernetes
* Look to prior releases if you still wish to apply heapster
Update Prometheus from v2.7.1 to v2.7.2 * https://github.com/prometheus/prometheus/releases/tag/v2.7.2
2019-03-05 08:08:12 +01:00
Update Kubernetes from v1.13.3 to v1.13.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134
2019-03-01 07:42:04 +01:00
## v1.13.4
* Kubernetes [v1.13.4](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134)
Update etcd from v3.3.11 to v3.3.12 * https://github.com/etcd-io/etcd/releases/tag/v3.3.12
2019-02-09 20:54:54 +01:00
* Update etcd from v3.3.11 to [v3.3.12](https://github.com/etcd-io/etcd/releases/tag/v3.3.12)
Update Calico from v3.5.1 to v3.5.2 * https://docs.projectcalico.org/v3.5/releases/
2019-02-26 06:23:13 +01:00
* Update Calico from v3.5.0 to [v3.5.2](https://docs.projectcalico.org/v3.5/releases/)
Upgrade to support terraform-provider-google v2.0+ * Support terraform-provider-google v1.19.0, v1.19.1, v1.20.0 and v2.0+ (and allow for future 2.x.y releases) * Require terraform-provider-google v1.19.0 or newer. v1.19.0 introduced `network_interface` fields `network_ip` and `nat_ip` to deprecate `address` and `assigned_nat_ip`. Those deprecated fields are removed in terraform-provider-google v2.0 * https://github.com/terraform-providers/terraform-provider-google/releases/tag/v2.0.0
2019-02-20 09:54:19 +01:00
* Assign priorityClassNames to critical cluster and node components ([#406](https://github.com/poseidon/typhoon/pull/406))
Update Kubernetes from v1.13.3 to v1.13.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134
2019-03-01 07:42:04 +01:00
* Inform node out-of-resource eviction and scheduler preemption and ordering
* Add CoreDNS readiness probe ([#410](https://github.com/poseidon/typhoon/pull/410))
Update Calico from v3.5.0 to v3.5.1 * Fix in confd https://github.com/projectcalico/confd/pull/205
2019-02-09 20:49:31 +01:00
Document and recommend terraform-provider-matchbox v0.2.3 * https://github.com/coreos/terraform-provider-matchbox/releases/tag/v0.2.3
2019-02-17 00:01:44 +01:00
#### Bare-Metal
Update links to Matchbox, terraform-provider-ct, etc. * Matchbox, terraform-provider-matchbox, and terraform-provider-ct have moved to the poseidon Github organization
2019-05-04 19:46:07 +02:00
* Recommend updating [terraform-provider-matchbox](https://github.com/poseidon/terraform-provider-matchbox) plugin from v0.2.2 to [v0.2.3](https://github.com/poseidon/terraform-provider-matchbox/releases/tag/v0.2.3) ([#402](https://github.com/poseidon/typhoon/pull/402))
Update Kubernetes from v1.13.3 to v1.13.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134
2019-03-01 07:42:04 +01:00
* Improve docs on using Ubiquiti EdgeOS with bare-metal clusters ([#413](https://github.com/poseidon/typhoon/pull/413))
Document and recommend terraform-provider-matchbox v0.2.3 * https://github.com/coreos/terraform-provider-matchbox/releases/tag/v0.2.3
2019-02-17 00:01:44 +01:00
Set the Google Cloud minimum CPU platform to Intel Haswell * Intel Haswell or better is available in every zone around the world * Neither Kubernetes nor Typhoon have a particular minimum processor family. However, a few Google Cloud zones still default to Sandy/Ivy bridge (scheduled to shift April 2019). Price is only based on machine type so it is beneficial to opt for the next processor family * Intel Haswell is a suitable minimum since it still allows plenty of liberty in choosing any region or machine type * Likely a slight increase to preemption probability in a few zones, but any lower probability on Sandy/Ivy bridge is due to lower desirability as they're phased out * https://cloud.google.com/compute/docs/regions-zones/
2019-02-18 21:54:07 +01:00
#### Google Cloud
Upgrade to support terraform-provider-google v2.0+ * Support terraform-provider-google v1.19.0, v1.19.1, v1.20.0 and v2.0+ (and allow for future 2.x.y releases) * Require terraform-provider-google v1.19.0 or newer. v1.19.0 introduced `network_interface` fields `network_ip` and `nat_ip` to deprecate `address` and `assigned_nat_ip`. Those deprecated fields are removed in terraform-provider-google v2.0 * https://github.com/terraform-providers/terraform-provider-google/releases/tag/v2.0.0
2019-02-20 09:54:19 +01:00
* Support `terraform-provider-google` v2.0+ ([#407](https://github.com/poseidon/typhoon/pull/407))
Update Kubernetes from v1.13.3 to v1.13.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134
2019-03-01 07:42:04 +01:00
* Require `terraform-provider-google` v1.19+ (**action required**)
Set the Google Cloud minimum CPU platform to Intel Haswell * Intel Haswell or better is available in every zone around the world * Neither Kubernetes nor Typhoon have a particular minimum processor family. However, a few Google Cloud zones still default to Sandy/Ivy bridge (scheduled to shift April 2019). Price is only based on machine type so it is beneficial to opt for the next processor family * Intel Haswell is a suitable minimum since it still allows plenty of liberty in choosing any region or machine type * Likely a slight increase to preemption probability in a few zones, but any lower probability on Sandy/Ivy bridge is due to lower desirability as they're phased out * https://cloud.google.com/compute/docs/regions-zones/
2019-02-18 21:54:07 +01:00
* Set the minimum CPU platform to Intel Haswell ([#405](https://github.com/poseidon/typhoon/pull/405))
* Haswell or better is available in every zone (no price change)
* A few zones still default to Sandy/Ivy Bridge (shifts in April 2019)
Raise nginx-ingress liveness/readiness timeout * Under heavy load, avoid timeouts causing nginx-ingress restarts https://github.com/kubernetes/ingress-nginx/pull/3737
2019-02-09 21:23:12 +01:00
#### Addons
Update Kubernetes from v1.13.3 to v1.13.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134
2019-03-01 07:42:04 +01:00
* Modernize Prometheus rules and alerts ([#404](https://github.com/poseidon/typhoon/pull/404))
Improve Prometheus rules and alerts and Grafana dashboards * Collate upstream rules, alerts, and dashboards and tune for use in Typhoon * Previously, a well-chosen (but older) set of rules, alerts, and dashboards were maintained to reflect metric name changes
2019-02-18 21:05:27 +01:00
* Drop extraneous metrics ([#397](https://github.com/poseidon/typhoon/pull/397))
Add Kubernetes pod name to metrics discovered from service endpoints * Prometheus queries from some upstreams use joins of node-exporter and kube-state-metrics metrics by (namespace,pod). Add the Kubernetes pod name to service endpoint metrics * Rename the kubernetes_namespace field to namespace * Honor labels since kube-state-metrics already include a `pod` field that should not be overridden
2019-02-08 08:26:59 +01:00
* Add `pod` name label to metrics discovered via service endpoints
* Rename `kubernetes_namespace` label to `namespace`
Add links and clarifications in CHANGES for release
2019-03-02 20:26:12 +01:00
* Modernize Grafana and dashboards, see [docs](https://typhoon.psdn.io/addons/grafana/) ([#403](https://github.com/poseidon/typhoon/pull/403), [#404](https://github.com/poseidon/typhoon/pull/404))
Update Grafana from v6.0.0-beta3 to v6.0.0 * https://github.com/grafana/grafana/releases/tag/v6.0.0 * http://docs.grafana.org/guides/whats-new-in-v6-0/
2019-02-26 06:43:43 +01:00
* Upgrade Grafana from v5.4.3 to [v6.0.0](https://github.com/grafana/grafana/releases/tag/v6.0.0)!
Upgrade Grafana to v6.0.0-beta2 and enable Explore UI * Upgrade Grafana from v5.4.3 to v6.0.0-beta2 * Enable Grafana Explore UI while still using only the Viewer role (inspect/edit without saving) * http://docs.grafana.org/guides/whats-new-in-v6-0/
2019-02-17 21:36:40 +01:00
* Enable Grafana [Explore](http://docs.grafana.org/guides/whats-new-in-v6-0/#explore) UI as a Viewer (inspect/edit without saving)
Update nginx-ingress from v0.22.0 to v0.23.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.23.0
2019-03-01 10:18:54 +01:00
* Update nginx-ingress from v0.22.0 to v0.23.0
* Raise nginx-ingress liveness/readiness timeout to 5 seconds
* Remove nginx-ingess default-backend ([#401](https://github.com/poseidon/typhoon/pull/401))
Raise nginx-ingress liveness/readiness timeout * Under heavy load, avoid timeouts causing nginx-ingress restarts https://github.com/kubernetes/ingress-nginx/pull/3737
2019-02-09 21:23:12 +01:00
Add links and clarifications in CHANGES for release
2019-03-02 20:26:12 +01:00
#### Fedora Atomic
* Build Kubelet [system container](https://github.com/poseidon/system-containers) with buildah. The image is an OCI format and slightly larger.
Add CHANGES note about reducing the pod eviciton timeout
2019-02-02 23:54:18 +01:00
## v1.13.3
Update Kubernetes from v1.13.2 to v1.13.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1133
2019-02-02 08:26:13 +01:00
* Kubernetes [v1.13.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1133)
Update etcd from v3.3.10 to v3.3.11 * https://github.com/etcd-io/etcd/releases/tag/v3.3.11
2019-01-12 09:20:47 +01:00
* Update etcd from v3.3.10 to [v3.3.11](https://github.com/etcd-io/etcd/blob/master/CHANGELOG-3.3.md#v3311-2019-1-11)
Update CoreDNS from v1.3.0 to v1.3.1 * https://coredns.io/2019/01/13/coredns-1.3.1-release/
2019-01-16 06:24:35 +01:00
* Update CoreDNS from v1.3.0 to [v1.3.1](https://coredns.io/2019/01/13/coredns-1.3.1-release/)
Switch CoreDNS to use the forward plugin instead of proxy * Use the forward plugin to forward to upstream resolvers, instead of the proxy plugin. The forward plugin is reported to be a faster alternative since it can re-use open sockets * https://coredns.io/explugins/forward/ * https://coredns.io/plugins/proxy/ * https://github.com/kubernetes/kubernetes/issues/73254
2019-01-31 07:25:23 +01:00
* Switch from the `proxy` plugin to the faster `forward` plugin for upsteam resolvers
Update Calico from v3.4.0 to v3.5.0 * https://docs.projectcalico.org/v3.5/releases/
2019-01-28 01:34:30 +01:00
* Update Calico from v3.4.0 to [v3.5.0](https://docs.projectcalico.org/v3.5/releases/)
Update flannel from v0.10.0 to v0.11.0 * https://github.com/coreos/flannel/releases/tag/v0.11.0
2019-01-30 06:51:25 +01:00
* Update flannel from v0.10.0 to [v0.11.0](https://github.com/coreos/flannel/releases/tag/v0.11.0)
Add CHANGES note about reducing the pod eviciton timeout
2019-02-02 23:54:18 +01:00
* Reduce pod eviction timeout for deleting pods on unready nodes to 1 minute
* Respond more quickly to node preemption (previously 5 minutes)
Update nginx-ingress from v0.21.0 to v0.22.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.22.0
2019-01-17 07:59:46 +01:00
* Fix automatic worker deletion on shutdown for cloud platforms
Fix instance shutdown automatic worker deletion on clouds * Fix a regression caused by lowering the Kubelet TLS client certificate to system:nodes group (#100) since dropping cluster-admin dropped the Kubelet's ability to delete nodes. * On clouds where workers can scale down (manual terraform apply, AWS spot termination, Azure low priority deletion), worker shutdown runs the delete-node.service to remove a node to prevent NotReady nodes from accumulating * Allow Kubelets to delete cluster nodes via system:nodes group. Kubelets acting with system:node and kubelet-delete ClusterRoles is still an improvement over acting as cluster-admin
2019-01-15 08:24:41 +01:00
* Lowering Kubelet privileges in [#372](https://github.com/poseidon/typhoon/pull/372) dropped a needed node deletion authorization. Scale-in due to manual terraform apply (any cloud), AWS spot termination, or Azure low priority deletion left old nodes registered, requiring manual deletion (`kubectl delete node name`)
Update etcd from v3.3.10 to v3.3.11 * https://github.com/etcd-io/etcd/releases/tag/v3.3.11
2019-01-12 09:20:47 +01:00
Add AWS ingress_zone_id output with NLB DNS name's Route53 zone id * DNS zones served by AWS Route53 may use AWS's special alias records (other DNS providers would use a CNAME) to resolve the ingress NLB. Alias records require the NLB DNS name's DNS zone id (not the cluster `dns_zone_id`)
2019-01-14 01:37:12 +01:00
#### AWS
* Add `ingress_zone_id` output with the NLB DNS name's Route53 zone for use in alias records ([#380](https://github.com/poseidon/typhoon/pull/380))
Fix azure provider warning, rename a public_ip field * azurerm_public_ip (used internally) added a field `allocation_method` to replace the field `public_ip_address_allocation` (deprecated) * Require terraform-provider-azurerm v1.21+ * https://github.com/terraform-providers/terraform-provider-azurerm/pull/2576
2019-01-28 02:52:35 +01:00
#### Azure
* Fix azure provider warning, `public_ip` `allocation_method` replaces `public_ip_address_allocation`
* Require `terraform-provider-azurerm` v1.21+ (action required)
Update kube-state-metrics exporter from v1.4.0 to v1.5.0 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.5.0
2019-01-12 23:23:34 +01:00
#### Addons
Update nginx-ingress from v0.21.0 to v0.22.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.22.0
2019-01-17 07:59:46 +01:00
* Update nginx-ingress from v0.21.0 to v0.22.0
Update Prometheus from v2.7.0 to v2.7.1 * https://github.com/prometheus/prometheus/releases/tag/v2.7.1
2019-02-02 09:13:24 +01:00
* Update Prometheus from v2.6.0 to v2.7.1
Update kube-state-metrics exporter from v1.4.0 to v1.5.0 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.5.0
2019-01-12 23:23:34 +01:00
* Update kube-state-metrics from v1.4.0 to v1.5.0
Allow kube-state-metrics PodDisruptionBudget metrics * Update kube-state-metrics ClusterRole to allow collecting poddisruptionbudget metrics (exported as kube_poddisruptionbudget_*) * https://github.com/kubernetes/kube-state-metrics/pull/551 * Bump addon-resizer from v1.7 to v1.8.4
2019-01-22 05:07:31 +01:00
* Fix ClusterRole to collect and export PodDisruptionBudget metrics ([#383](https://github.com/poseidon/typhoon/pull/383))
Update node-exporter from v0.15.2 to v0.17.0 * node-exporter renamed multiple metrics that are reflected in changes to Prometheus rules and Grafana dashboard expressions
2019-01-22 09:19:55 +01:00
* Update node-exporter from v0.15.2 to v0.17.0
Update Grafana from v5.4.2 to v5.4.3 * https://github.com/grafana/grafana/releases/tag/v5.4.3
2019-01-16 06:05:46 +01:00
* Update Grafana from v5.4.2 to v5.4.3
Update kube-state-metrics exporter from v1.4.0 to v1.5.0 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.5.0
2019-01-12 23:23:34 +01:00
Update etcd from v3.3.10 to v3.3.11 * https://github.com/etcd-io/etcd/releases/tag/v3.3.11
2019-01-12 09:20:47 +01:00
## v1.13.2
Update Kubernetes from v1.13.1 to v1.13.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1132
2019-01-11 08:21:21 +01:00
* Kubernetes [v1.13.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1132)
Use a lower-privilege Kubelet kubeconfig in system:nodes * Kubelets can use a lower-privilege TLS client certificate with Org system:nodes and a binding to the system:node ClusterRole * Admin kubeconfig's continue to belong to Org system:masters to provide cluster-admin (available in assets/auth/kubeconfig or as a Terraform output kubeconfig-admin) * Remove bare-metal output variable kubeconfig
2019-01-03 08:30:42 +01:00
* Add ServiceAccounts for `kube-apiserver` and `kube-scheduler` ([#370](https://github.com/poseidon/typhoon/pull/370))
Update Kubernetes from v1.13.1 to v1.13.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1132
2019-01-11 08:21:21 +01:00
* Use lower-privilege TLS client certificates for Kubelets ([#372](https://github.com/poseidon/typhoon/pull/372))
* Use HTTPS liveness probes for `kube-scheduler` and `kube-controller-manager` ([#377](https://github.com/poseidon/typhoon/pull/377))
* Update CoreDNS from v1.2.6 to [v1.3.0](https://coredns.io/2018/12/15/coredns-1.3.0-release/)
Enable the certificates.k8s.io API to issue cluster certificates * System components that require certificates signed by the cluster CA can submit a CSR to the apiserver, have an administrator inspect and approve it, and be issued a certificate * Configure kube-controller-manager to sign Approved CSR's using the cluster CA private key * Admins are responsible for approving or denying CSRs, otherwise, no certificate is issued. Read the Kubernetes docs carefully and verify the entity making the request and the authorization level * https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster
2019-01-07 02:23:58 +01:00
* Allow the `certificates.k8s.io` API to issue certificates signed by the cluster CA ([#376](https://github.com/poseidon/typhoon/pull/376))
* Configure controller manager to sign CSRs that are manually [approved](https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster) by an administrator
Add ServiceAccounts for kube-apiserver and kube-scheduler * Add ServiceAccounts and ClusterRoleBindings for kube-apiserver and kube-scheduler * Remove the ClusterRoleBinding for the kube-system default ServiceAccount * Rename the CA certificate CommonName for consistency with upstream
2019-01-02 03:40:11 +01:00
Change AWS default type from t2.small to t3.small * T3 is the next generation general purpose burstable instance type. Compared with t2.small, the t3.small is cheaper, has 2 vCPU (instead of 1) and provides 5 Gbps of pod-to-pod bandwidth (instead of 1 Gbps)
2018-12-18 21:29:27 +01:00
#### AWS
Change AWS worker modules' default type from t2.small to t3.small * Worker instance types weren't updated in #365
2019-01-12 09:07:48 +01:00
* Change `controller_type` and `worker_type` default from t2.small to t3.small ([#365](https://github.com/poseidon/typhoon/pull/365))
Change AWS default type from t2.small to t3.small * T3 is the next generation general purpose burstable instance type. Compared with t2.small, the t3.small is cheaper, has 2 vCPU (instead of 1) and provides 5 Gbps of pod-to-pod bandwidth (instead of 1 Gbps)
2018-12-18 21:29:27 +01:00
* t3.small is cheaper, provides 2 vCPU (instead of 1), and 5 Gbps of pod-to-pod bandwidth!
Use a lower-privilege Kubelet kubeconfig in system:nodes * Kubelets can use a lower-privilege TLS client certificate with Org system:nodes and a binding to the system:node ClusterRole * Admin kubeconfig's continue to belong to Org system:masters to provide cluster-admin (available in assets/auth/kubeconfig or as a Terraform output kubeconfig-admin) * Remove bare-metal output variable kubeconfig
2019-01-03 08:30:42 +01:00
#### Bare-Metal
* Remove the `kubeconfig` output variable
Update Prometheus addon from v2.5.0 to v2.6.0 * https://github.com/prometheus/prometheus/releases/tag/v2.6.0
2018-12-27 16:35:12 +01:00
#### Addons
* Update Prometheus from v2.5.0 to v2.6.0
Update changelog for v1.13.1 release
2018-12-17 23:28:27 +01:00
## v1.13.1
Update Kubernetes from v1.13.0 to v1.13.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1131
2018-12-15 20:43:44 +01:00
* Kubernetes [v1.13.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1131)
Update terraform-provider-ct plugin from v0.2.1 to v0.3.0 * Provide migration instructions for upgrading terraform-provider-ct in-place for v1.12.2+ clusters * Require switching from ~/.terraformrc to the Terraform third-party plugins directory ~/.terraform.d/plugins/ * Require Container Linux 1688.5.3 or newer
2018-12-17 23:13:50 +01:00
* Update Calico from v3.3.2 to [v3.4.0](https://docs.projectcalico.org/v3.4/releases/) ([#362](https://github.com/poseidon/typhoon/pull/362))
Update Calico from v3.3.2 to v3.4.0 * https://docs.projectcalico.org/v3.4/releases/
2018-12-16 02:41:25 +01:00
* Install CNI plugins with an init container rather than a sidecar
* Improve the `calico-node` ClusterRole
Update terraform-provider-ct plugin from v0.2.1 to v0.3.0 * Provide migration instructions for upgrading terraform-provider-ct in-place for v1.12.2+ clusters * Require switching from ~/.terraformrc to the Terraform third-party plugins directory ~/.terraform.d/plugins/ * Require Container Linux 1688.5.3 or newer
2018-12-17 23:13:50 +01:00
* Recommend updating `terraform-provider-ct` plugin from v0.2.1 to v0.3.0 ([#363](https://github.com/poseidon/typhoon/pull/363))
* [Migration](https://typhoon.psdn.io/topics/maintenance/#upgrade-terraform-provider-ct) instructions for upgrading `terraform-provider-ct` in-place for v1.12.2+ clusters (**action required**)
* [Require](https://typhoon.psdn.io/topics/maintenance/#terraform-plugins-directory) switching from `~/.terraformrc` to the Terraform [third-party plugins](https://www.terraform.io/docs/configuration/providers.html#third-party-plugins) directory `~/.terraform.d/plugins/`
* Require Container Linux 1688.5.3 or newer
Update Kubernetes from v1.13.0 to v1.13.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1131
2018-12-15 20:43:44 +01:00
Increase GCP TCP proxy apiserver backend timeout to 5 minutes * On GCP, kubectl port-forward connections to pods are closed after a timeout (unlike AWS NLB's or Azure load balancers) * Increase the GCP apiserver backend service timeout from 1 minute to 5 minutes to be more similar to AWS/Azure LB behavior
2018-12-15 23:20:53 +01:00
#### Google Cloud
* Increase TCP proxy apiserver backend service timeout from 1 minute to 5 minutes ([#361](https://github.com/poseidon/typhoon/pull/361))
* Align `port-forward` behavior closer to AWS/Azure (no timeout)
Update Grafana from v5.4.0 to v5.4.2 * https://github.com/grafana/grafana/releases/tag/v5.4.2 * https://github.com/grafana/grafana/releases/tag/v5.4.1
2018-12-15 21:39:03 +01:00
#### Addons
* Update Grafana from v5.4.0 to v5.4.2
Update Kubernetes from v1.13.0 to v1.13.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1131
2018-12-15 20:43:44 +01:00
## v1.13.0
Update Kubernetes from v1.12.3 to v1.13.0
2018-12-04 05:44:32 +01:00
* Kubernetes [v1.13.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1130)
Update Calico from v3.3.1 to v3.3.2 * https://docs.projectcalico.org/v3.3/releases/
2018-12-07 07:56:55 +01:00
* Update Calico from v3.3.1 to [v3.3.2](https://docs.projectcalico.org/v3.3/releases/)
Update Kubernetes from v1.12.3 to v1.13.0
2018-12-04 05:44:32 +01:00
Disable Grafana login form, admin user can't be disabled * Example manifests aim to provide a read-only dashboard visible to any users with network access (i.e. kubectl port-forward, LAN) * Problem: Grafana always has an admin user, even with the user management system disabled * Disable the login form to prevent admin login
2018-11-29 06:56:34 +01:00
#### Addons
Update Grafana from v5.3.4 to v5.4.0 * https://github.com/grafana/grafana/releases/tag/v5.4.0
2018-12-06 10:33:50 +01:00
* Update Grafana from v5.3.4 to v5.4.0
Disable Grafana login form, admin user can't be disabled * Example manifests aim to provide a read-only dashboard visible to any users with network access (i.e. kubectl port-forward, LAN) * Problem: Grafana always has an admin user, even with the user management system disabled * Disable the login form to prevent admin login
2018-11-29 06:56:34 +01:00
* Disable Grafana login form, since admin user can't be disabled ([#352](https://github.com/poseidon/typhoon/pull/352))
* Example manifests aim to provide a read-only dashboard view
Update CHANGES changelog for release
2018-11-28 18:23:13 +01:00
## v1.12.3
Update Kubernetes from v1.12.2 to v1.12.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md/#v1123
2018-11-27 06:02:59 +01:00
* Kubernetes [v1.12.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md#v1123)
* Add `enable_reporting` variable (default "false") to provide upstreams with usage data ([#345](https://github.com/poseidon/typhoon/pull/345))
Set kube-apiserver kubelet preferred address types * Prefer InternalIP and ExternalIP over the node's hostname, to match upstream behavior and kubeadm * Previously, hostname-override was used to set node names to internal IP's to work around some cloud providers not resolving hostnames for instances (e.g. DO droplets)
2018-11-03 23:04:08 +01:00
* Change kube-apiserver `--kubelet-preferred-address-types` to InternalIP,ExternalIP,Hostname
Update Calico from v3.3.0 to v3.3.1 * Structure Calico and flannel manifests * Rename kube-flannel mentions to just flannel
2018-11-10 22:35:35 +01:00
* Update Calico from v3.3.0 to [v3.3.1](https://docs.projectcalico.org/v3.3/releases/)
Fix Calico Felix reporting usage data, require opt-in * Calico Felix has been reporting anonymous usage data about the version and cluster size, which violates Typhoon's privacy policy where analytics should be opt-in only * Add a variable enable_reporting (default: false) to allow opting in to reporting usage data to Calico (or future components)
2018-11-20 07:45:02 +01:00
* Disable Felix usage reporting by default ([#345](https://github.com/poseidon/typhoon/pull/345))
Add flannel resource request and mount only /run/flannel
2018-11-12 00:57:20 +01:00
* Improve flannel manifests
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
* [Rename](https://github.com/poseidon/terraform-render-bootkube/commit/d045a8e6b8eccfbb9d69bb51953b5a93d23f67f7) `kube-flannel` DaemonSet to `flannel` and `kube-flannel-cfg` ConfigMap to `flannel-config`
Measure DigitalOcean network performance * Measuring pod-to-pod bandwidth in a few regions (NYC3, FRA1, SFO1) shows DigitalOcean has made some improvements
2018-11-12 06:05:07 +01:00
* [Drop](https://github.com/poseidon/terraform-render-bootkube/commit/39f9afb3360ec642e5b98457c8bd07eda35b6c96) unused mounts and add a CPU resource request
Update CoreDNS from v1.2.4 to v1.2.6 * https://coredns.io/2018/11/05/coredns-1.2.6-release/
2018-11-19 01:45:53 +01:00
* Update CoreDNS from v1.2.4 to [v1.2.6](https://coredns.io/2018/11/05/coredns-1.2.6-release/)
* Enable CoreDNS `loop` and `loadbalance` plugins ([#340](https://github.com/poseidon/typhoon/pull/340))
Update Kubernetes from v1.12.2 to v1.12.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md/#v1123
2018-11-27 06:02:59 +01:00
* Fix pod-checkpointer log noise and checkpointable pods detection ([#346](https://github.com/poseidon/typhoon/pull/346))
Update bootkube image version from v0.13.0 to v0.14.0 * https://github.com/kubernetes-incubator/bootkube/releases/tag/v0.14.0
2018-11-07 08:35:11 +01:00
* Use kubernetes-incubator/bootkube v0.14.0
Recommend switch from ~/.terraformrc to 3rd-party plugin dir * Switch tutorials from using ~/.terraformrc to using the 3rd-party plugin directory so 3rd-party plugins can be pinned * Continue to show using terraform-provider-ct v0.2.2. Updating to a newer version is only safe once all managed clusters are v1.12.2 or higher
2018-11-27 09:08:51 +01:00
* [Recommend](https://typhoon.psdn.io/topics/maintenance/#terraform-plugins-directory) switching from `~/.terraformrc` to the Terraform [third-party plugins](https://www.terraform.io/docs/configuration/providers.html#third-party-plugins) directory `~/.terraform.d/plugins/`.
* Allows pinning `terraform-provider-ct` and `terraform-provider-matchbox` versions
* Improves safety of later plugin version migrations
Set kube-apiserver kubelet preferred address types * Prefer InternalIP and ExternalIP over the node's hostname, to match upstream behavior and kubeadm * Previously, hostname-override was used to set node names to internal IP's to work around some cloud providers not resolving hostnames for instances (e.g. DO droplets)
2018-11-03 23:04:08 +01:00
Use eviction policy Delete for Low priority VMSS workers * Fix issue where Azure defaults to Deallocate eviction policy, which required manually restarting deallocated workers * Require terraform-provider-azurerm v1.19+ to support setting the eviction_policy
2018-11-19 01:57:54 +01:00
#### Azure
* Use eviction policy `Delete` for `Low` priority virtual machine scale set workers ([#343](https://github.com/poseidon/typhoon/pull/343))
* Fix issue where Azure defaults to `Deallocate` eviction policy, which required manually restarting deallocated instances. `Delete` policy aligns Azure with AWS and GCP behavior.
* Require `terraform-provider-azurerm` v1.19+ (action required)
Add Kubelet /etc/iscsi and iscsiadm mounts on bare-metal * Allow using iSCSI with Container Linux bare-metal clusters * Warning, iSCSI isn't part of Kubernetes conformance and isn't regularly evaluated
2018-01-19 20:34:47 +01:00
#### Bare-Metal
* Add Kubelet `/etc/iscsi` and `iscsadm` mounts on bare-metal for iSCSI ([#103](https://github.com/poseidon/typhoon/pull/103))
Update Prometheus from v2.4.3 to v2.5.0 * https://github.com/prometheus/prometheus/releases/tag/v2.5.0
2018-11-07 07:16:12 +01:00
#### Addons
Update ngninx-ingress from v0.20.0 to v0.21.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.21.0
2018-11-27 06:57:34 +01:00
* Update nginx-ingress from v0.20.0 to v0.21.0
Update Prometheus from v2.4.3 to v2.5.0 * https://github.com/prometheus/prometheus/releases/tag/v2.5.0
2018-11-07 07:16:12 +01:00
* Update Prometheus from v2.4.3 to v2.5.0
Update Grafana from v5.3.2 to v5.3.4 * https://github.com/grafana/grafana/releases/tag/v5.3.3 * https://github.com/grafana/grafana/releases/tag/v5.3.4
2018-11-19 01:42:50 +01:00
* Update Grafana from v5.3.2 to v5.3.4
Update Prometheus from v2.4.3 to v2.5.0 * https://github.com/prometheus/prometheus/releases/tag/v2.5.0
2018-11-07 07:16:12 +01:00
Update Kubernetes from v1.12.1 to v1.12.2 * Update CoreDNS from v1.2.2 to v1.2.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md#v1122 * https://coredns.io/2018/10/17/coredns-1.2.4-release/ * https://coredns.io/2018/10/16/coredns-1.2.3-release/
2018-10-28 00:47:57 +02:00
## v1.12.2
* Kubernetes [v1.12.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md#v1122)
* Update CoreDNS from 1.2.2 to [1.2.4](https://github.com/coredns/coredns/releases/tag/v1.2.4)
Update Calico from v3.2.3 to v3.3.0 * https://docs.projectcalico.org/v3.3/releases/
2018-10-24 05:30:30 +02:00
* Update Calico from v3.2.3 to [v3.3.0](https://docs.projectcalico.org/v3.3/releases/)
Disable Kubelet read-only port 10255 * We can finally disable the Kubelet read-only port 10255! * Journey: https://github.com/poseidon/typhoon/issues/322#issuecomment-431073073
2018-05-14 03:16:10 +02:00
* Disable Kubelet read-only port ([#324](https://github.com/poseidon/typhoon/pull/324))
Update Calico from v3.2.3 to v3.3.0 * https://docs.projectcalico.org/v3.3/releases/
2018-10-24 05:30:30 +02:00
* Fix CoreDNS AntiAffinity spec to prefer spreading replicas
Ignore controller user_data changes to allow plugin updates * Updating the `terraform-provider-ct` plugin is known to produce a `user_data` diff in all pre-existing clusters. Applying the diff to pre-existing cluster destroys controller nodes * Ignore changes to controller `user_data`. Once all managed clusters use a release containing this change, it is possible to update the `terraform-provider-ct` plugin (worker `user_data` will still be modified) * Changing the module `ref` for an existing cluster and re-applying is still NOT supported (although this PR would protect controllers from being destroyed)
2018-10-28 23:11:47 +01:00
* Ignore controller node user-data changes ([#335](https://github.com/poseidon/typhoon/pull/335))
* Once all managed clusters use v1.12.2, it is possible to update `terraform-provider-ct`
Fix CoreDNS AntiAffinity spec to prefer spreading replicas * Pods were still being scheduled at random due to a typo
2018-10-18 07:19:57 +02:00
Add disk_iops variable for AWS * Setting disk_iops is required for disk_type io1 * https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html#EBSVolumeTypes
2018-10-15 16:59:35 +02:00
#### AWS
* Add `disk_iops` variable for EBS volume IOPS ([#314](https://github.com/poseidon/typhoon/pull/314))
Add primary field to ip_configuration required by Azure * Required by terraform-provider-azurerm v1.17+ * https://github.com/terraform-providers/terraform-provider-azurerm/pull/2035
2018-10-28 01:42:36 +02:00
#### Azure
Use new azurerm_network_interface_backend_address_pool_association * Require terraform-provider-azurerm v1.17+ * Inline load_balancer_backend_address_pools_ids is deprecated and scheduled for removal in the v2.0 provider * https://github.com/terraform-providers/terraform-provider-azurerm/pull/2079
2018-10-28 06:46:10 +01:00
* Use new `azurerm_network_interface_backend_address_pool_association` ([#332](https://github.com/poseidon/typhoon/pull/332))
* Require `terraform-provider-azurerm` v1.17+ (action required)
* Add `primary` field to `ip_configuration` needed by v1.17+ ([#331](https://github.com/poseidon/typhoon/pull/331))
Add primary field to ip_configuration required by Azure * Required by terraform-provider-azurerm v1.17+ * https://github.com/terraform-providers/terraform-provider-azurerm/pull/2035
2018-10-28 01:42:36 +02:00
Add DigitalOcean AAAA DNS records resolving to workers * Improve the workers "round-robin" DNS FQDN that is created with each cluster by adding AAAA records * CNAME's resolving to the DigitalOcean `workers_dns` output can be followed to find a droplet's IPv4 or IPv6 address * The CNI portmap plugin doesn't support IPv6. Hosting IPv6 apps is possible, but requires editing the nginx-ingress addon with `hostNetwork: true`
2018-10-28 07:01:50 +01:00
#### DigitalOcean
* Add AAAA DNS records resolving to worker nodes ([#333](https://github.com/poseidon/typhoon/pull/333))
* Hosting IPv6 apps requires editing nginx-ingress with `hostNetwork: true`
Add an IPv6 address and forwarding rules on Google Cloud * Allowing serving IPv6 applications via Kubernetes Ingress on Typhoon Google Cloud clusters * Add `ingress_static_ipv6` output variable for use in AAAA DNS records
2018-10-28 22:17:12 +01:00
#### Google Cloud
Ignore controller user_data changes to allow plugin updates * Updating the `terraform-provider-ct` plugin is known to produce a `user_data` diff in all pre-existing clusters. Applying the diff to pre-existing cluster destroys controller nodes * Ignore changes to controller `user_data`. Once all managed clusters use a release containing this change, it is possible to update the `terraform-provider-ct` plugin (worker `user_data` will still be modified) * Changing the module `ref` for an existing cluster and re-applying is still NOT supported (although this PR would protect controllers from being destroyed)
2018-10-28 23:11:47 +01:00
* Add an IPv6 address and IPv6 forwarding rules for load balancing IPv6 Ingress ([#334](https://github.com/poseidon/typhoon/pull/334))
Add an IPv6 address and forwarding rules on Google Cloud * Allowing serving IPv6 applications via Kubernetes Ingress on Typhoon Google Cloud clusters * Add `ingress_static_ipv6` output variable for use in AAAA DNS records
2018-10-28 22:17:12 +01:00
* Add `ingress_static_ipv6` output variable for use in AAAA DNS records
* Allow serving IPv6 applications via Kubernetes Ingress
Configure Heapster to source metrics from Kubelet authenticated API * Heapster can now get nodes (i.e. kubelets) from the apiserver and source metrics from the Kubelet authenticated API (10250) instead of the Kubelet HTTP read-only API (10255) * https://github.com/kubernetes/heapster/blob/master/docs/source-configuration.md * Use the heapster service account token via Kubelet bearer token authn/authz. * Permit Heapster to skip CA verification. The CA cert does not contain IP SANs and cannot since nodes get random IPs that aren't known upfront. Heapster obtains the node list from the apiserver, so the risk of spoofing a node is limited. For the same reason, Prometheus scrapes must skip CA verification for scraping Kubelet's provided by the apiserver. * https://github.com/poseidon/typhoon/blob/v1.12.1/addons/prometheus/config.yaml#L68 * Create a heapster ClusterRole to work around the default Kubernetes `system:heapster` ClusterRole lacking the proper GET `nodes/stats` access. See https://github.com/kubernetes/heapster/issues/1936
2018-10-19 05:39:30 +02:00
#### Addons
* Configure Heapster to scrape Kubelets with bearer token auth ([#323](https://github.com/poseidon/typhoon/pull/323))
Update Grafana from v5.3.1 to v5.3.2 * https://github.com/grafana/grafana/releases/tag/v5.3.2
2018-10-29 03:44:22 +01:00
* Update Grafana from v5.3.1 to v5.3.2
Configure Heapster to source metrics from Kubelet authenticated API * Heapster can now get nodes (i.e. kubelets) from the apiserver and source metrics from the Kubelet authenticated API (10250) instead of the Kubelet HTTP read-only API (10255) * https://github.com/kubernetes/heapster/blob/master/docs/source-configuration.md * Use the heapster service account token via Kubelet bearer token authn/authz. * Permit Heapster to skip CA verification. The CA cert does not contain IP SANs and cannot since nodes get random IPs that aren't known upfront. Heapster obtains the node list from the apiserver, so the risk of spoofing a node is limited. For the same reason, Prometheus scrapes must skip CA verification for scraping Kubelet's provided by the apiserver. * https://github.com/poseidon/typhoon/blob/v1.12.1/addons/prometheus/config.yaml#L68 * Create a heapster ClusterRole to work around the default Kubernetes `system:heapster` ClusterRole lacking the proper GET `nodes/stats` access. See https://github.com/kubernetes/heapster/issues/1936
2018-10-19 05:39:30 +02:00
Add links to header to CHANGES
2018-10-17 17:53:23 +02:00
## v1.12.1
Update Kubernetes from v1.11.3 to v1.12.1 * Mount an empty dir for the controller-manager to work around https://github.com/kubernetes/kubernetes/issues/68973 * Update coreos/pod-checkpointer to strip affinity from checkpointed pod manifests. Kubernetes v1.12.0-rc.1 introduced a default affinity that appears on checkpointed manifests; but it prevented scheduling and checkpointed pods should not have an affinity, they're run directly by the Kubelet on the local node * https://github.com/kubernetes-incubator/bootkube/issues/1001 * https://github.com/kubernetes/kubernetes/pull/68173
2018-09-22 09:02:37 +02:00
* Kubernetes [v1.12.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md#v1121)
Update etcd from v3.3.9 to v3.3.10 * https://github.com/etcd-io/etcd/blob/master/CHANGELOG-3.3.md#v3310-2018-10-10
2018-10-13 22:14:37 +02:00
* Update etcd from v3.3.9 to [v3.3.10](https://github.com/etcd-io/etcd/blob/master/CHANGELOG-3.3.md#v3310-2018-10-10)
Add links to header to CHANGES
2018-10-17 17:53:23 +02:00
* Update CoreDNS from 1.1.3 to [1.2.2](https://github.com/coredns/coredns/releases/tag/v1.2.2)
* Update Calico from v3.2.1 to [v3.2.3](https://docs.projectcalico.org/v3.2/releases/)
* Raise scheduler and controller-manager replicas to the larger of 2 or the number of controller nodes ([#312](https://github.com/poseidon/typhoon/pull/312))
Raise scheduler/controller-manager replicas in multi-master * Continue to ensure scheduler and controller-manager run at least two replicas to support performing kubectl edits on single-master clusters (no change) * For multi-master clusters, set scheduler / controller-manager replica count to the number of masters (e.g. a 3-master cluster previously used replicas:2, now replicas:3)
2018-10-13 22:16:18 +02:00
* Single-controller clusters continue to run 2 replicas as before
Add links to header to CHANGES
2018-10-17 17:53:23 +02:00
* Raise default CoreDNS replicas to the larger of 2 or the number of controller nodes ([#313](https://github.com/poseidon/typhoon/pull/313))
Raise CoreDNS replica count to 2 or more * Run at least two replicas of CoreDNS to better support rolling updates (previously, kube-dns had a pod nanny) * On multi-master clusters, set the CoreDNS replica count to match the number of masters (e.g. a 3-master cluster previously used replicas:1, now replicas:3) * Add AntiAffinity preferred rule to favor distributing CoreDNS pods across controller nodes nodes
2018-10-14 01:21:22 +02:00
* Add AntiAffinity preferred rule to favor spreading CoreDNS pods
Add links to header to CHANGES
2018-10-17 17:53:23 +02:00
* Annotate control plane and addon containers to use the Docker runtime seccomp profile ([#319](https://github.com/poseidon/typhoon/pull/319))
* Override Kubernetes default behavior that starts containers with `seccomp=unconfined`
Update CoreDNS and Calico versions * Update CoreDNS from 1.1.3 to 1.2.2 * Update Calico from v3.2.1 to v3.2.3
2018-10-02 16:06:41 +02:00
Remove Azure admin_password (disabled) now that its optional * Requires terraform-provider-azurerm v1.16.0 or higher https://github.com/terraform-providers/terraform-provider-azurerm/pull/1958
2018-10-14 06:55:46 +02:00
#### Azure
Add links to header to CHANGES
2018-10-17 17:53:23 +02:00
* Remove `admin_password` field (disabled) since it is now optional
Remove Azure admin_password (disabled) now that its optional * Requires terraform-provider-azurerm v1.16.0 or higher https://github.com/terraform-providers/terraform-provider-azurerm/pull/1958
2018-10-14 06:55:46 +02:00
* Require `terraform-provider-azurerm` v1.16+ (action required)
Add support for Flatcar Linux bare-metal cached_install * Support bare-metal cached_install=true mode with Flatcar Linux where assets are fetched from the Matchbox assets cache instead of from the upstream Flatcar download server * Skipped in original Flatcar support to keep it simple https://github.com/poseidon/typhoon/pull/209
2018-10-15 11:27:32 +02:00
#### Bare-Metal
* Add support for `cached_install` mode with Flatcar Linux ([#315](https://github.com/poseidon/typhoon/pull/315))
Require terraform-provider-digitalocean plugin ~> 1.0 * Require a terraform-provider-digitalocean plugin version of 1.0 or higher within the same major version (e.g. allow 1.1 but not 2.0) * Change requirement from ~> 0.1.2 (which allowed up to but not including 1.0 release)
2018-10-02 16:41:53 +02:00
#### DigitalOcean
Remove Azure admin_password (disabled) now that its optional * Requires terraform-provider-azurerm v1.16.0 or higher https://github.com/terraform-providers/terraform-provider-azurerm/pull/1958
2018-10-14 06:55:46 +02:00
* Require `terraform-provider-digitalocean` v1.0+ (action required)
Require terraform-provider-digitalocean plugin ~> 1.0 * Require a terraform-provider-digitalocean plugin version of 1.0 or higher within the same major version (e.g. allow 1.1 but not 2.0) * Change requirement from ~> 0.1.2 (which allowed up to but not including 1.0 release)
2018-10-02 16:41:53 +02:00
Update Prometheus from v2.3.2 to v2.4.2 * https://github.com/prometheus/prometheus/releases/tag/v2.4.0 * https://github.com/prometheus/prometheus/releases/tag/v2.4.1 * https://github.com/prometheus/prometheus/releases/tag/v2.4.2
2018-09-22 07:22:21 +02:00
#### Addons
Update nginx-ingress from v0.19.0 to v0.20.0
2018-10-17 06:34:17 +02:00
* Update nginx-ingress from v0.19.0 to v0.20.0
Update Prometheus from v2.4.2 to v2.4.3 * https://github.com/prometheus/prometheus/releases/tag/v2.4.3
2018-10-17 06:29:41 +02:00
* Update Prometheus from v2.3.2 to v2.4.3
Update Grafana from v5.3.0 to v5.3.1 * https://github.com/grafana/grafana/releases/tag/v5.3.1
2018-10-17 06:23:44 +02:00
* Update Grafana from v5.2.4 to v5.3.1
Update Prometheus from v2.3.2 to v2.4.2 * https://github.com/prometheus/prometheus/releases/tag/v2.4.0 * https://github.com/prometheus/prometheus/releases/tag/v2.4.1 * https://github.com/prometheus/prometheus/releases/tag/v2.4.2
2018-09-22 07:22:21 +02:00
Update Kubernetes from v1.11.2 to v1.11.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1113
2018-09-14 03:48:07 +02:00
## v1.11.3
* Kubernetes [v1.11.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1113)
Add docs for Azure Ingress and worker pools * Azure worker pools must be in the same region as the cluster itself unfortunately
2018-08-28 07:24:52 +02:00
* Introduce Typhoon for Azure as alpha ([#288](https://github.com/poseidon/typhoon/pull/288))
* Special thanks @justaugustus for an earlier variant
Update Calico from v3.1.3 to v3.2.1 * Add new bird and felix readiness checks * Read MTU from ConfigMap veth_mtu * Add RBAC read for serviceaccounts * Remove invalid description from CRDs
2018-08-15 08:49:33 +02:00
* Update Calico from v3.1.3 to v3.2.1 ([#278](https://github.com/poseidon/typhoon/pull/278))
Remove AWS security rule allowing ICMP packets to nodes * Deny ICMP packets for consistency across Typhoon clusters on various clouds and because there isn't much need to allow them
2018-08-22 06:16:16 +02:00
#### AWS
Fix docs mentions of ELBs to NLBs * Typhoon AWS clusters use an NLB rather than an ELB, since v1.10.5 * Add a few missing links in CHANGES
2018-08-22 06:25:22 +02:00
* Remove firewall rule allowing ICMP packets to nodes ([#285](https://github.com/poseidon/typhoon/pull/285))
Remove AWS security rule allowing ICMP packets to nodes * Deny ICMP packets for consistency across Typhoon clusters on various clouds and because there isn't much need to allow them
2018-08-22 06:16:16 +02:00
Remove unofficial bare-metal *_networkds variables * Remove controller_networkds and worker_networkds variables. These variables were always listed as experimental, unsupported, and excluded from documentation in anticipation of Container Linux Config snippets * Use Container Linux Config snippets on bare-metal instead. They provide safer, more powerful, and more elegant host customization
2018-08-13 01:44:13 +02:00
#### Bare-Metal
* Remove `controller_networkds` and `worker_networkds` variables. Use Container Linux Config snippets [#277](https://github.com/poseidon/typhoon/pull/277)
Remove GCP firewall rule allowing Nginx Ingress health * Nginx Ingress addon no longer uses hostNework so Prometheus may scrape port 10254 via the CNI network, rather than via the host address
2018-08-22 06:06:03 +02:00
#### Google Cloud
Fix firewall to allow etcd client traffic between controllers * Broaden internal-etcd firewall rule to allow etcd client traffic (2379) from other controller nodes * Previously, kube-apiservers were only able to connect to their node's local etcd peer. While master node outages were tolerated, reaching a healthy peer took longer than neccessary in some cases * Reduce time needed to bootstrap a cluster
2018-08-22 08:21:05 +02:00
* Fix firewall to allow etcd client port 2379 traffic between controller nodes ([#287](https://github.com/poseidon/typhoon/pull/287))
* kube-apiservers were only able to connect to their node's local etcd peer. While master node outages were tolerated, reaching a healthy peer took longer than neccessary in some cases
* Reduce time needed to bootstrap the cluster
Fix docs mentions of ELBs to NLBs * Typhoon AWS clusters use an NLB rather than an ELB, since v1.10.5 * Add a few missing links in CHANGES
2018-08-22 06:25:22 +02:00
* Remove firewall rule allowing workers to access Nginx Ingress health check ([#284](https://github.com/poseidon/typhoon/pull/284))
Remove GCP firewall rule allowing Nginx Ingress health * Nginx Ingress addon no longer uses hostNework so Prometheus may scrape port 10254 via the CNI network, rather than via the host address
2018-08-22 06:06:03 +02:00
* Nginx Ingress addon no longer uses hostNetwork, Prometheus scrapes via CNI network
Update kube-state-metrics from v1.3.1 to v1.4.0
2018-08-29 18:36:47 +02:00
#### Addons
Update nginx-ingress from 0.17.1 to 0.19.0 * If using --enable-ssl-passthrough or exposing TCP/UDP services, be aware of https://github.com/kubernetes/ingress-nginx/pull/3038 * Workarounds until the fix merges are to stay on 0.17.1, use the suggested development image, or revert to securityContext `runAsNonRoot: false` for a while (less secure)
2018-09-09 01:12:38 +02:00
* Update nginx-ingress from 0.17.1 to 0.19.0
Update kube-state-metrics from v1.3.1 to v1.4.0
2018-08-29 18:36:47 +02:00
* Update kube-state-metrics from v1.3.1 to v1.4.0
Update Grafana from v5.2.2 to v5.2.4 * https://github.com/grafana/grafana/releases/tag/v5.2.3 * https://github.com/grafana/grafana/releases/tag/v5.2.4
2018-09-09 00:41:20 +02:00
* Update Grafana from 5.2.2 to 5.2.4
Update kube-state-metrics from v1.3.1 to v1.4.0
2018-08-29 18:36:47 +02:00
Update Kubernetes from v1.11.1 to v1.11.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1112
2018-08-08 06:56:02 +02:00
## v1.11.2
Update etcd from v3.3.4 to v3.3.5 * https://github.com/coreos/etcd/releases/tag/v3.3.5
2018-05-10 10:01:25 +02:00
Update Kubernetes from v1.11.1 to v1.11.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1112
2018-08-08 06:56:02 +02:00
* Kubernetes [v1.11.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1112)
Update etcd from v3.3.8 to v3.3.9 * https://github.com/coreos/etcd/blob/master/CHANGELOG-3.3.md#v339-2018-07-24
2018-07-29 20:27:37 +02:00
* Update etcd from v3.3.8 to [v3.3.9](https://github.com/coreos/etcd/blob/master/CHANGELOG-3.3.md#v339-2018-07-24)
Update from bootkube v0.12.0 to v0.13.0
2018-07-29 20:20:17 +02:00
* Use kubernetes-incubator/bootkube v0.13.0
Fix Kublet version for Fedora Atomic modules * Release v1.11.1 erroneously left Fedora Atomic clusters using the v1.11.0 Kubelet. The rest of the control plane ran v1.11.1 as expected * Update Kubelet from v1.11.0 to v1.11.1 so Fedora Atomic matches Container Linux * Container Linux modules were not affected
2018-07-29 21:13:29 +02:00
* Fix Fedora Atomic modules' Kubelet version ([#270](https://github.com/poseidon/typhoon/issues/270))
Update from bootkube v0.12.0 to v0.13.0
2018-07-29 20:20:17 +02:00
Support Container Linux Config snippets on bare-metal
2018-07-26 07:44:07 +02:00
#### Bare-Metal
* Introduce [Container Linux Config snippets](https://typhoon.psdn.io/advanced/customization/#container-linux) on bare-metal
* Validate and additively merge custom Container Linux Configs during terraform plan
* Define files, systemd units, dropins, networkd configs, mounts, users, and more
Fix docs mentions of ELBs to NLBs * Typhoon AWS clusters use an NLB rather than an ELB, since v1.10.5 * Add a few missing links in CHANGES
2018-08-22 06:25:22 +02:00
* [Require](https://typhoon.psdn.io/cl/bare-metal/#terraform-setup) `terraform-provider-ct` plugin v0.2.1 (**action required!**)
Support Container Linux Config snippets on bare-metal
2018-07-26 07:44:07 +02:00
Update Grafana from v5.2.1 to v5.2.2 * https://github.com/grafana/grafana/releases/tag/v5.2.2
2018-07-29 20:12:56 +02:00
#### Addons
Update nginx-ingress from 0.16.2 to 0.17.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.17.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.17.0
2018-08-08 09:45:20 +02:00
* Update nginx-ingress from 0.16.2 to 0.17.1
Add nginx-ingress addon manifests for bare-metal
2018-08-11 21:14:23 +02:00
* Add nginx-ingress manifests for bare-metal
Update Grafana from v5.2.1 to v5.2.2 * https://github.com/grafana/grafana/releases/tag/v5.2.2
2018-07-29 20:12:56 +02:00
* Update Grafana from 5.2.1 to 5.2.2
Update heapster from v1.5.3 to v1.5.4 * https://github.com/kubernetes/heapster/releases/tag/v1.5.4
2018-07-29 20:15:47 +02:00
* Update heapster from v1.5.3 to v1.5.4
Update Grafana from v5.2.1 to v5.2.2 * https://github.com/grafana/grafana/releases/tag/v5.2.2
2018-07-29 20:12:56 +02:00
Support Container Linux Config snippets on bare-metal
2018-07-26 07:44:07 +02:00
## v1.11.1
Update Kubernetes from v1.11.0 to v1.11.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1111
2018-07-20 09:36:58 +02:00
* Kubernetes [v1.11.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1111)
Update Prometheus from v2.3.1 to v2.3.2 * https://github.com/prometheus/prometheus/releases/tag/v2.3.2
2018-07-14 23:24:50 +02:00
#### Addons
* Update Prometheus from v2.3.1 to v2.3.2
Fix Kublet version for Fedora Atomic modules * Release v1.11.1 erroneously left Fedora Atomic clusters using the v1.11.0 Kubelet. The rest of the control plane ran v1.11.1 as expected * Update Kubelet from v1.11.0 to v1.11.1 so Fedora Atomic matches Container Linux * Container Linux modules were not affected
2018-07-29 21:13:29 +02:00
#### Errata
* Fedora Atomic modules shipped with Kubelet v1.11.0, instead of v1.11.1. Fixed in [#270](https://github.com/poseidon/typhoon/issues/270).
Update changelog and docs for release
2018-07-04 21:27:26 +02:00
## v1.11.0
Update Kubernetes from v1.10.5 to v1.11.0 * Force apiserver to stop listening on 127.0.0.1:8080 * Remove deprecated Kubelet `--allow-privileged`. Defaults to true. Use `PodSecurityPolicy` if limiting is desired * https://github.com/kubernetes/kubernetes/releases/tag/v1.11.0 * https://github.com/poseidon/terraform-render-bootkube/pull/68
2018-06-28 07:47:35 +02:00
* Kubernetes [v1.11.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1110)
* Force apiserver to stop listening on `127.0.0.1:8080`
Replace kube-dns with CoreDNS * Add system:coredns ClusterRole and binding * Annotate CoreDNS for Prometheus metrics scraping * Remove kube-dns deployment, service, & service account * https://github.com/poseidon/terraform-render-bootkube/pull/71 * https://kubernetes.io/blog/2018/06/27/kubernetes-1.11-release-announcement/
2018-07-02 04:41:57 +02:00
* Replace `kube-dns` with [CoreDNS](https://coredns.io/) ([#261](https://github.com/poseidon/typhoon/pull/261))
* Edit the `coredns` ConfigMap to [customize](https://coredns.io/plugins/)
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
* CoreDNS doesn't use a resizer. For large clusters, scaling may be required.
Update Kubernetes from v1.10.5 to v1.11.0 * Force apiserver to stop listening on 127.0.0.1:8080 * Remove deprecated Kubelet `--allow-privileged`. Defaults to true. Use `PodSecurityPolicy` if limiting is desired * https://github.com/kubernetes/kubernetes/releases/tag/v1.11.0 * https://github.com/poseidon/terraform-render-bootkube/pull/68
2018-06-28 07:47:35 +02:00
Update Fedora Atomic from 27 to 28 on AWS
2018-07-01 02:25:54 +02:00
#### AWS
* Update from Fedora Atomic 27 to 28 ([#258](https://github.com/poseidon/typhoon/pull/258))
Update Fedora Atomic from 27 to 28 on bare-metal
2018-07-04 20:16:04 +02:00
#### Bare-Metal
* Update from Fedora Atomic 27 to 28 ([#263](https://github.com/poseidon/typhoon/pull/263))
Remove deprecated ingress_static_ip and controllers_ipv4_public outputs
2018-07-02 05:47:46 +02:00
#### Google
Promote Typhoon Google Cloud for Container Linux to stable
2018-07-02 07:49:33 +02:00
* Promote Google Cloud to stable
Update Fedora Atomic from 27 to 28 on GCP
2018-07-01 03:12:36 +02:00
* Update from Fedora Atomic 27 to 28 ([#259](https://github.com/poseidon/typhoon/pull/259))
Remove deprecated ingress_static_ip and controllers_ipv4_public outputs
2018-07-02 05:47:46 +02:00
* Remove `ingress_static_ip` module output. Use `ingress_static_ipv4`.
* Remove `controllers_ipv4_public` module output.
Update Grafana from 5.1.4 to 5.2.1 * http://docs.grafana.org/guides/whats-new-in-v5-2/ * https://github.com/grafana/grafana/releases/tag/v5.2.0 * https://github.com/grafana/grafana/releases/tag/v5.2.1
2018-07-02 05:55:34 +02:00
#### Addons
Update Nginx Ingress controller from 0.15.0 to 0.16.2 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.16.2 * https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md
2018-07-03 07:06:22 +02:00
* Update nginx-ingress from 0.15.0 to 0.16.2
Update Grafana from 5.1.4 to 5.2.1 * http://docs.grafana.org/guides/whats-new-in-v5-2/ * https://github.com/grafana/grafana/releases/tag/v5.2.0 * https://github.com/grafana/grafana/releases/tag/v5.2.1
2018-07-02 05:55:34 +02:00
* Update Grafana from 5.1.4 to [5.2.1](http://docs.grafana.org/guides/whats-new-in-v5-2/)
Update heapster from v1.5.2 to v1.5.3
2018-07-02 06:07:52 +02:00
* Update heapster from v1.5.2 to v1.5.3
Update Grafana from 5.1.4 to 5.2.1 * http://docs.grafana.org/guides/whats-new-in-v5-2/ * https://github.com/grafana/grafana/releases/tag/v5.2.0 * https://github.com/grafana/grafana/releases/tag/v5.2.1
2018-07-02 05:55:34 +02:00
Clarify AWS module output names and changes
2018-06-24 00:15:57 +02:00
## v1.10.5
Update Kubernetes from v1.10.4 to v1.10.5 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1105
2018-06-22 07:51:39 +02:00
* Kubernetes [v1.10.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1105)
Update etcd from v3.3.7 to v3.3.8 * https://github.com/coreos/etcd/releases/tag/v3.3.8
2018-06-20 06:55:05 +02:00
* Update etcd from v3.3.6 to v3.3.8 ([#243](https://github.com/poseidon/typhoon/pull/243), [#247](https://github.com/poseidon/typhoon/pull/247))
Fix possible deadlock for provisioning bare-metal clusters * Closes #235
2018-06-15 07:43:01 +02:00
Change kube-apiserver port from 443 to 6443 * Adjust firewall rules, security groups, cloud load balancers, and generated kubeconfig's * Facilitates some future simplifications and cost reductions * Bare-Metal users who exposed kube-apiserver on a WAN via their router or load balancer will need to adjust its configuration. This is uncommon, most apiserver are on LAN and/or behind VPN so no routing infrastructure is configured with the port number
2018-06-19 06:57:58 +02:00
#### AWS
* Switch `kube-apiserver` port from 443 to 6443 ([#248](https://github.com/poseidon/typhoon/pull/248))
Combine NLBs to use one NLB per cluster * Simplify clusters to come with a single NLB * Listen for apiserver traffic on port 6443 and forward to controllers (with healthy apiserver) * Listen for ingress traffic on ports 80/443 and forward to workers (with healthy ingress controller) * Reduce cost of default clusters by 1 NLB ($18.14/month) * Keep using CNAME records to the `ingress_dns_name` NLB and the nginx-ingress addon for Ingress (up to a few million RPS) * Users with heavy traffic (many million RPS) can create their own separate NLB(s) for Ingress and use the new output worker target groups * Fix issue where additional worker pools come with an extraneous network load balancer
2018-06-19 07:56:32 +02:00
* Combine apiserver and ingress NLBs ([#249](https://github.com/poseidon/typhoon/pull/249))
Clarify AWS module output names and changes
2018-06-24 00:15:57 +02:00
* Reduce cost by ~$18/month per cluster. Typhoon AWS clusters now use one network load balancer.
* Ingress addon users may keep using CNAME records to the `ingress_dns_name` module output (few million RPS)
* Ingress users with heavy traffic (many million RPS) should create a separate NLB(s)
* Worker pools no longer include an extraneous load balancer. Remove worker module's `ingress_dns_name` output
Disable AWS detailed monitoring on worker nodes * Basic monitoring (free) is sufficient for casual console browsing * Detailed monitoring (paid) is not leveraged for CloudWatch anyway * Favor Prometheus for cloud-agnostic metrics, aggregation, and alerting
2018-06-22 08:57:38 +02:00
* Disable detailed (paid) monitoring on worker nodes ([#251](https://github.com/poseidon/typhoon/pull/251))
Clarify AWS module output names and changes
2018-06-24 00:15:57 +02:00
* Favor Prometheus for cloud-agnostic metrics, aggregation, and alerting
* Add `worker_target_group_http` and `worker_target_group_https` module outputs to allow custom load balancing
* Add `target_group_http` and `target_group_https` worker module outputs to allow custom load balancing
Change kube-apiserver port from 443 to 6443 * Adjust firewall rules, security groups, cloud load balancers, and generated kubeconfig's * Facilitates some future simplifications and cost reductions * Bare-Metal users who exposed kube-apiserver on a WAN via their router or load balancer will need to adjust its configuration. This is uncommon, most apiserver are on LAN and/or behind VPN so no routing infrastructure is configured with the port number
2018-06-19 06:57:58 +02:00
Fix possible deadlock for provisioning bare-metal clusters * Closes #235
2018-06-15 07:43:01 +02:00
#### Bare-Metal
Change kube-apiserver port from 443 to 6443 * Adjust firewall rules, security groups, cloud load balancers, and generated kubeconfig's * Facilitates some future simplifications and cost reductions * Bare-Metal users who exposed kube-apiserver on a WAN via their router or load balancer will need to adjust its configuration. This is uncommon, most apiserver are on LAN and/or behind VPN so no routing infrastructure is configured with the port number
2018-06-19 06:57:58 +02:00
* Switch `kube-apiserver` port from 443 to 6443 ([#248](https://github.com/poseidon/typhoon/pull/248))
* Users who exposed kube-apiserver on a WAN via their router/load-balancer will need to adjust its configuration (e.g. DNAT 6443). Most apiservers are on a LAN (internal, VPN-only, etc) so if you didn't specially configure network gear for 443, no change is needed. (possible action required)
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
* Fix possible deadlock when provisioning clusters larger than 10 nodes ([#244](https://github.com/poseidon/typhoon/pull/244))
Update etcd from v3.3.6 to v3.3.7
2018-06-15 07:28:11 +02:00
Change kube-apiserver port from 443 to 6443 * Adjust firewall rules, security groups, cloud load balancers, and generated kubeconfig's * Facilitates some future simplifications and cost reductions * Bare-Metal users who exposed kube-apiserver on a WAN via their router or load balancer will need to adjust its configuration. This is uncommon, most apiserver are on LAN and/or behind VPN so no routing infrastructure is configured with the port number
2018-06-19 06:57:58 +02:00
#### DigitalOcean
* Switch `kube-apiserver` port from 443 to 6443 ([#248](https://github.com/poseidon/typhoon/pull/248))
* Update firewall rules and generated kubeconfig's
Use global HTTP/TCP proxy load balancing for Ingress on GCP * Switch Ingress from regional network load balancers to global HTTP/TCP Proxy load balancing * Reduce cost by ~$19/month per cluster. Google bills the first 5 global and regional forwarding rules separately. Typhoon clusters now use 3 global and 0 regional forwarding rules. * Worker pools no longer include an extraneous load balancer. Remove worker module's `ingress_static_ip` output. * Add `ingress_static_ipv4` output variable * Add `worker_instance_group` output to allow custom global load balancing * Deprecate `controllers_ipv4_public` module output * Deprecate `ingress_static_ip` module output. Use `ingress_static_ipv4`
2018-05-07 08:21:53 +02:00
#### Google Cloud
* Use global HTTP and TCP proxy load balancing for Kubernetes Ingress ([#252](https://github.com/poseidon/typhoon/pull/252))
* Switch Ingress from regional network load balancers to global HTTP/TCP Proxy load balancing
* Reduce cost by ~$19/month per cluster. Google bills the first 5 global and regional forwarding rules separately. Typhoon clusters now use 3 global and 0 regional forwarding rules.
* Worker pools no longer include an extraneous load balancer. Remove worker module's `ingress_static_ip` output
Clarify AWS module output names and changes
2018-06-24 00:15:57 +02:00
* Allow using nginx-ingress addon on Fedora Atomic clusters ([#200](https://github.com/poseidon/typhoon/issues/200))
Use global HTTP/TCP proxy load balancing for Ingress on GCP * Switch Ingress from regional network load balancers to global HTTP/TCP Proxy load balancing * Reduce cost by ~$19/month per cluster. Google bills the first 5 global and regional forwarding rules separately. Typhoon clusters now use 3 global and 0 regional forwarding rules. * Worker pools no longer include an extraneous load balancer. Remove worker module's `ingress_static_ip` output. * Add `ingress_static_ipv4` output variable * Add `worker_instance_group` output to allow custom global load balancing * Deprecate `controllers_ipv4_public` module output * Deprecate `ingress_static_ip` module output. Use `ingress_static_ipv4`
2018-05-07 08:21:53 +02:00
* Add `worker_instance_group` module output to allow custom global load balancing
Clarify AWS module output names and changes
2018-06-24 00:15:57 +02:00
* Add `instance_group` worker module output to allow custom global load balancing
* Deprecate `ingress_static_ip` module output. Add `ingress_static_ipv4` module output instead.
Use global HTTP/TCP proxy load balancing for Ingress on GCP * Switch Ingress from regional network load balancers to global HTTP/TCP Proxy load balancing * Reduce cost by ~$19/month per cluster. Google bills the first 5 global and regional forwarding rules separately. Typhoon clusters now use 3 global and 0 regional forwarding rules. * Worker pools no longer include an extraneous load balancer. Remove worker module's `ingress_static_ip` output. * Add `ingress_static_ipv4` output variable * Add `worker_instance_group` output to allow custom global load balancing * Deprecate `controllers_ipv4_public` module output * Deprecate `ingress_static_ip` module output. Use `ingress_static_ipv4`
2018-05-07 08:21:53 +02:00
* Deprecate `controllers_ipv4_public` module output
Update CLUO from v0.6.0 to v0.7.0
2018-06-14 00:05:22 +02:00
#### Addons
* Update CLUO from v0.6.0 to v0.7.0 ([#242](https://github.com/poseidon/typhoon/pull/242))
Drop hostNetwork from nginx-ingress addon * Both flannel and Calico support host port via `portmap` * Allows writing NetworkPolicies that reference ingress pods in `from` or `to`. HostNetwork pods were difficult to write network policy for since they could circumvent the CNI network to communicate with pods on the same node.
2018-06-22 09:46:41 +02:00
* Update Prometheus from v2.3.0 to v2.3.1
* Update Grafana from 5.1.3 to 5.1.4
* Drop `hostNetwork` from nginx-ingress addon
* Both flannel and Calico support host port via `portmap`
* Allows writing NetworkPolicies that reference ingress pods in `from` or `to`. HostNetwork pods were difficult to write network policy for since they could circumvent the CNI network to communicate with pods on the same node.
Update CLUO from v0.6.0 to v0.7.0
2018-06-14 00:05:22 +02:00
Update prometheus from v2.2.1 to v2.3.0
2018-06-09 20:43:10 +02:00
## v1.10.4
Update Kubernetes from v1.10.3 to v1.10.4
2018-06-07 08:23:11 +02:00
* Kubernetes [v1.10.4](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1104)
Update etcd from v3.3.5 to v3.3.6 * https://github.com/coreos/etcd/releases/tag/v3.3.6
2018-06-07 08:18:37 +02:00
* Update etcd from v3.3.5 to v3.3.6
Update Calico from v3.1.2 to v3.1.3 * https://github.com/projectcalico/calico/releases/tag/v3.1.3 * https://github.com/projectcalico/cni-plugin/releases/tag/v3.1.3
2018-05-31 06:31:12 +02:00
* Update Calico from v3.1.2 to v3.1.3
Add Prometheus liveness and readiness probes
2018-05-31 07:33:16 +02:00
#### Addons
Drop hostNetwork from nginx-ingress addon * Both flannel and Calico support host port via `portmap` * Allows writing NetworkPolicies that reference ingress pods in `from` or `to`. HostNetwork pods were difficult to write network policy for since they could circumvent the CNI network to communicate with pods on the same node.
2018-06-22 09:46:41 +02:00
* Update Prometheus from v2.2.1 to v2.3.0
Add Prometheus liveness and readiness probes
2018-05-31 07:33:16 +02:00
* Add Prometheus liveness and readiness probes
Annotate Grafana so Prometheus scrapes metrics
2018-05-31 07:37:47 +02:00
* Annotate Grafana service so Prometheus scrapes metrics
Label namespaces to ease writing Network Policies
2018-06-09 20:44:21 +02:00
* Label namespaces to ease writing Network Policies
Add Prometheus liveness and readiness probes
2018-05-31 07:33:16 +02:00
Update Kubernetes from v1.10.2 to v1.10.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1103 * Update Calico from v3.1.1 to v3.1.2
2018-05-22 05:41:34 +02:00
## v1.10.3
* Kubernetes [v1.10.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1103)
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Add [Flatcar Linux](https://docs.flatcar-linux.org/) (Container Linux derivative) as an option for AWS and bare-metal (thanks @kinvolk folks)
Configure Prometheus to scrape Kubelets directly * Use Kubelet bearer token authn/authz to scrape metrics * Drop RBAC permission from nodes/proxy to nodes/metrics * Stop proxying kubelet scrapes through the apiserver, since this required higher privilege (nodes/proxy) and can add load to the apiserver on large clusters
2018-05-14 08:49:45 +02:00
* Allow bearer token authentication to the Kubelet ([#216](https://github.com/poseidon/typhoon/issues/216))
Allow bearer token authn/authz to the Kubelet * Require Webhook authorization to the Kubelet * Switch apiserver X509 client cert org to systems:masters to grant the apiserver admin and satisfy the authorization requirement. kubectl commands like logs or exec that have the apiserver make requests of a kubelet continue to work as before * https://kubernetes.io/docs/admin/kubelet-authentication-authorization/ * https://github.com/poseidon/typhoon/issues/215
2018-05-14 08:20:42 +02:00
* Require Webhook authorization to the Kubelet
* Switch apiserver X509 client cert org to satisfy new authorization requirement
Rename container_linux_ bare-metal variables * Allow for Container Linux derivatives * Replace container_linux_channel variable with `os_channel` * Replace `container_linux_version` variable with `os_version` * Please change values `stable`, `beta`, or `alpha` to `coreos-stable`, `coreos-beta`, `coreos-alpha` (action required!)
2018-05-17 07:37:37 +02:00
* Require Terraform v0.11.x and drop support for v0.10.x ([migration guide](https://typhoon.psdn.io/topics/maintenance/#terraform-v011x))
* Update etcd from v3.3.4 to v3.3.5 ([#213](https://github.com/poseidon/typhoon/pull/213))
Update Kubernetes from v1.10.2 to v1.10.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1103 * Update Calico from v3.1.1 to v3.1.2
2018-05-22 05:41:34 +02:00
* Update Calico from v3.1.1 to v3.1.2
Update etcd from v3.3.4 to v3.3.5 * https://github.com/coreos/etcd/releases/tag/v3.3.5
2018-05-10 10:01:25 +02:00
Allow preemptible workers on AWS via spot instances * Add `worker_price` to allow worker spot instances. Defaults to empty string for the worker autoscaling group to use regular on-demand instances. * Add `spot_price` to internal `workers` module for spot worker pools * Note: Unlike GCP `preemptible` workers, spot instances require you to pick a bid price.
2018-04-29 22:19:00 +02:00
#### AWS
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Allow Flatcar Linux by setting `os_image` to flatcar-stable (default), flatcar-beta, flatcar-alpha ([#211](https://github.com/poseidon/typhoon/pull/211))
* Replace `os_channel` variable with `os_image` to align naming across clouds
* Please change values stable, beta, or alpha to coreos-stable, coreos-beta, coreos-alpha (**action required!**)
Allow Flatcar Linux os_image on AWS, rename os_channel * Replace os_channel variable with os_image to align naming across clouds. Users who set this option to stable, beta, or alpha should now set os_image to coreos-stable, coreos-beta, or coreos-alpha. * Default os_image to coreos-stable. This continues to use the most recent image from the stable channel as always. * Allow Container Linux derivative Flatcar Linux by setting os_image to `flatcar-stable`, `flatcar-beta`, `flatcar-alpha`
2018-05-09 07:38:05 +02:00
* Allow preemptible workers via spot instances ([#202](https://github.com/poseidon/typhoon/pull/202))
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Add `worker_price` to allow worker spot instances. Default to empty string for the worker autoscaling group to use regular on-demand instances
Allow preemptible workers on AWS via spot instances * Add `worker_price` to allow worker spot instances. Defaults to empty string for the worker autoscaling group to use regular on-demand instances. * Add `spot_price` to internal `workers` module for spot worker pools * Note: Unlike GCP `preemptible` workers, spot instances require you to pick a bid price.
2018-04-29 22:19:00 +02:00
* Add `spot_price` to internal `workers` module for spot [worker pools](https://typhoon.psdn.io/advanced/worker-pools/)
Add bare-metal network_ip_autodetection_method variable for multi-NIC * Allow setting the Calico host IPv4 address autodetection method * Use Calico's default "first-found" method to support single NIC and bonded NIC nodes * Allow methods like `can-reach=IP` or `interface=REGEX` for multi NIC nodes * https://docs.projectcalico.org/v3.1/reference/node/configuration#ip-autodetection-methods
2018-05-15 08:35:16 +02:00
#### Bare-Metal
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Allow Flatcar Linux by setting `os_channel` to flatcar-stable, flatcar-beta, flatcar-alpha ([#220](https://github.com/poseidon/typhoon/pull/220))
Rename container_linux_ bare-metal variables * Allow for Container Linux derivatives * Replace container_linux_channel variable with `os_channel` * Replace `container_linux_version` variable with `os_version` * Please change values `stable`, `beta`, or `alpha` to `coreos-stable`, `coreos-beta`, `coreos-alpha` (action required!)
2018-05-17 07:37:37 +02:00
* Replace `container_linux_channel` variable with `os_channel`
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Please change values stable, beta, or alpha to coreos-stable, coreos-beta, coreos-alpha (**action required!**)
Rename container_linux_ bare-metal variables * Allow for Container Linux derivatives * Replace container_linux_channel variable with `os_channel` * Replace `container_linux_version` variable with `os_version` * Please change values `stable`, `beta`, or `alpha` to `coreos-stable`, `coreos-beta`, `coreos-alpha` (action required!)
2018-05-17 07:37:37 +02:00
* Replace `container_linux_version` variable with `os_version`
Add bare-metal network_ip_autodetection_method variable for multi-NIC * Allow setting the Calico host IPv4 address autodetection method * Use Calico's default "first-found" method to support single NIC and bonded NIC nodes * Allow methods like `can-reach=IP` or `interface=REGEX` for multi NIC nodes * https://docs.projectcalico.org/v3.1/reference/node/configuration#ip-autodetection-methods
2018-05-15 08:35:16 +02:00
* Add `network_ip_autodetection_method` variable for Calico host IPv4 address detection
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
* Use Calico's default "first-found" to support single NIC and bonded NIC nodes
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Allow [alternative](https://docs.projectcalico.org/v3.1/reference/node/configuration#ip-autodetection-methods) methods for multi NIC nodes, like can-reach=IP or interface=REGEX
Rename container_linux_ bare-metal variables * Allow for Container Linux derivatives * Replace container_linux_channel variable with `os_channel` * Replace `container_linux_version` variable with `os_version` * Please change values `stable`, `beta`, or `alpha` to `coreos-stable`, `coreos-beta`, `coreos-alpha` (action required!)
2018-05-17 07:37:37 +02:00
* Deprecate `container_linux_oem` variable
Add bare-metal network_ip_autodetection_method variable for multi-NIC * Allow setting the Calico host IPv4 address autodetection method * Use Calico's default "first-found" method to support single NIC and bonded NIC nodes * Allow methods like `can-reach=IP` or `interface=REGEX` for multi NIC nodes * https://docs.projectcalico.org/v3.1/reference/node/configuration#ip-autodetection-methods
2018-05-15 08:35:16 +02:00
Update Fedora Atomic from 27 to 28 on DigitalOcean * Fedora Atomic 27 images disappeared from DigitalOcean and forced this early update (there are known bugs)
2018-05-22 05:33:09 +02:00
#### DigitalOcean
* Update Fedora Atomic module to use Fedora Atomic 28 ([#225](https://github.com/poseidon/typhoon/pull/225))
* Fedora Atomic 27 images disappeared from DigitalOcean and forced this early update
Fix Prometheus data dir to /var/lib/prometheus * A data volume (emptyDir) is mounted to /var/lib/prometheus * Users could swap emptyDir for any desired volume if data persistence is desired. Prometheus previously defaulted to keeping its data in ./data relative to /prometheus. Override this behavior to store data in /var/lib/prometheus
2018-05-02 06:56:28 +02:00
#### Addons
* Fix Prometheus data directory location ([#203](https://github.com/poseidon/typhoon/pull/203))
Configure Prometheus to scrape Kubelets directly * Use Kubelet bearer token authn/authz to scrape metrics * Drop RBAC permission from nodes/proxy to nodes/metrics * Stop proxying kubelet scrapes through the apiserver, since this required higher privilege (nodes/proxy) and can add load to the apiserver on large clusters
2018-05-14 08:49:45 +02:00
* Configure Prometheus to scrape Kubelets directly with bearer token auth instead of proxying through the apiserver ([#217](https://github.com/poseidon/typhoon/pull/217))
* Security improvement: Drop RBAC permission from `nodes/proxy` to `nodes/metrics`
* Scale: Remove per-node proxied scrape load from the apiserver
Update Grafana from v5.1.2 to v5.1.3 * https://github.com/grafana/grafana/releases/tag/v5.1.3
2018-05-18 06:35:16 +02:00
* Update Grafana from v5.04 to v5.1.3 ([#208](https://github.com/poseidon/typhoon/pull/208))
Disable default Google Analytics in Grafana addon * Its come to my attention Grafana reports analytics data by default. Typhoon's philosophy requires user permission for data collection so the addon should have this disabled * http://docs.grafana.org/installation/configuration/#analytics
2018-05-10 10:13:54 +02:00
* Disable Grafana Google Analytics by default ([#214](https://github.com/poseidon/typhoon/issues/214))
Update nginx-ingress from 0.14.0 to 0.15.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.15.0
2018-05-18 06:42:55 +02:00
* Update nginx-ingress from 0.14.0 to 0.15.0
Annotate nginx-ingress addon for Prometheus auto-discovery * Add Google Cloud firewall rule to allow worker to worker access to health and metrics
2018-05-19 22:05:50 +02:00
* Annotate nginx-ingress service so Prometheus auto-discovers and scrapes service endpoints ([#222](https://github.com/poseidon/typhoon/pull/222))
Fix Prometheus data dir to /var/lib/prometheus * A data volume (emptyDir) is mounted to /var/lib/prometheus * Users could swap emptyDir for any desired volume if data persistence is desired. Prometheus previously defaulted to keeping its data in ./data relative to /prometheus. Override this behavior to store data in /var/lib/prometheus
2018-05-02 06:56:28 +02:00
Allow preemptible workers on AWS via spot instances * Add `worker_price` to allow worker spot instances. Defaults to empty string for the worker autoscaling group to use regular on-demand instances. * Add `spot_price` to internal `workers` module for spot worker pools * Note: Unlike GCP `preemptible` workers, spot instances require you to pick a bid price.
2018-04-29 22:19:00 +02:00
## v1.10.2
digital-ocean: Run etcd cluster on-host, across controllers * Run etcd peers with TLS across controller nodes * Deprecate self-hosted-etcd on the Digital Ocean platform * Distribute etcd TLS certificates as part of initial provisioning * Check the status of etcd by running `systemctl status etcd-member`
2017-10-04 09:07:48 +02:00
Update Kubernetes from v1.10.1 to v1.10.2 * https://github.com/kubernetes/kubernetes/releases/tag/v1.10.2
2018-04-28 09:03:29 +02:00
* Kubernetes [v1.10.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1102)
Update Kubernetes from v1.10.2 to v1.10.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1103 * Update Calico from v3.1.1 to v3.1.2
2018-05-22 05:41:34 +02:00
* [Introduce](https://typhoon.psdn.io/announce/#april-26-2018) Typhoon for Fedora Atomic ([#199](https://github.com/poseidon/typhoon/pull/199))
Update Calico from v3.0.4 to v3.1.1 * https://github.com/projectcalico/calico/releases/tag/v3.1.1 * https://github.com/projectcalico/calico/releases/tag/v3.1.0
2018-04-22 00:13:38 +02:00
* Update Calico from v3.0.4 to v3.1.1 ([#197](https://github.com/poseidon/typhoon/pull/197))
* https://www.projectcalico.org/announcing-calico-v3-1/
* https://github.com/projectcalico/calico/releases/tag/v3.1.0
Update etcd from v3.3.3 to v3.3.4 * https://github.com/coreos/etcd/releases/tag/v3.3.4
2018-04-28 08:57:26 +02:00
* Update etcd from v3.3.3 to v3.3.4
Add changelog notes for release
2018-04-29 21:04:44 +02:00
* Update kube-dns from v1.14.9 to v1.14.10
Update Calico from v3.0.4 to v3.1.1 * https://github.com/projectcalico/calico/releases/tag/v3.1.1 * https://github.com/projectcalico/calico/releases/tag/v3.1.0
2018-04-22 00:13:38 +02:00
Switch GCP network lb to global TCP proxy lb * Allow multi-controller clusters on Google Cloud * GCP regional network load balancers have a long open bug in which requests originating from a backend instance are routed to the instance itself, regardless of whether the health check passes or not. As a result, only the 0th controller node registers. We've recommended just using single master GCP clusters for a while * https://issuetracker.google.com/issues/67366622 * Workaround issue by switching to a GCP TCP Proxy load balancer. TCP proxy lb routes traffic to a backend service (global) of instance group backends. In our case, spread controllers across 3 zones (all regions have 3+ zones) and organize them in 3 zonal unmanaged instance groups that serve as backends. Allows multi-controller cluster creation * GCP network load balancers only allowed legacy HTTP health checks so kubelet 10255 was checked as an approximation of controller health. Replace with TCP apiserver health checks to detect unhealth or unresponsive apiservers. * Drawbacks: GCP provision time increases, tailed logs now timeout (similar tradeoff in AWS), controllers only span 3 zones instead of the exact number in the region * Workaround in Typhoon has been known and posted for 5 months, but there still appears to be no better alternative. Its probably time to support multi-master and accept the downsides
2018-04-15 09:50:43 +02:00
#### Google Cloud
* Add support for multi-controller clusters (i.e. multi-master) ([#54](https://github.com/poseidon/typhoon/issues/54), [#190](https://github.com/poseidon/typhoon/pull/190))
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
* Switch from Google Cloud network load balancer to a TCP proxy load balancer. Avoid a [bug](https://issuetracker.google.com/issues/67366622) in Google network load balancers that limited clusters to only bootstrapping one controller node.
Switch GCP network lb to global TCP proxy lb * Allow multi-controller clusters on Google Cloud * GCP regional network load balancers have a long open bug in which requests originating from a backend instance are routed to the instance itself, regardless of whether the health check passes or not. As a result, only the 0th controller node registers. We've recommended just using single master GCP clusters for a while * https://issuetracker.google.com/issues/67366622 * Workaround issue by switching to a GCP TCP Proxy load balancer. TCP proxy lb routes traffic to a backend service (global) of instance group backends. In our case, spread controllers across 3 zones (all regions have 3+ zones) and organize them in 3 zonal unmanaged instance groups that serve as backends. Allows multi-controller cluster creation * GCP network load balancers only allowed legacy HTTP health checks so kubelet 10255 was checked as an approximation of controller health. Replace with TCP apiserver health checks to detect unhealth or unresponsive apiservers. * Drawbacks: GCP provision time increases, tailed logs now timeout (similar tradeoff in AWS), controllers only span 3 zones instead of the exact number in the region * Workaround in Typhoon has been known and posted for 5 months, but there still appears to be no better alternative. Its probably time to support multi-master and accept the downsides
2018-04-15 09:50:43 +02:00
* Add TCP health check for apiserver pods on controllers. Replace kubelet check approximation.
Update kube-state-metrics from v1.3.0 to v1.3.1 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.3.1
2018-04-16 02:08:58 +02:00
#### Addons
Add changelog notes for release
2018-04-29 21:04:44 +02:00
* Update nginx-ingress from 0.12.0 to 0.14.0
Update kube-state-metrics from v1.3.0 to v1.3.1 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.3.1
2018-04-16 02:08:58 +02:00
* Update kube-state-metrics from v1.3.0 to v1.3.1
## v1.10.1
Update Kubernetes from v1.10.0 to v1.10.1 * Use kubernetes-incubator/bootkube v0.12.0
2018-04-13 05:23:35 +02:00
* Kubernetes [v1.10.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1101)
Add etcd metrics, Prometheus scrapes, and Grafana dash * Use etcd v3.3 --listen-metrics-urls to expose only metrics data via http://0.0.0.0:2381 on controllers * Add Prometheus discovery for etcd peers on controller nodes * Temporarily drop two noisy Prometheus alerts
2018-03-29 06:45:24 +02:00
* Enable etcd v3.3 metrics endpoint ([#175](https://github.com/poseidon/typhoon/pull/175))
Fix bare-metal multiple apply/ssh on Terraform v0.11.4+ * Terraform v0.11.4 introduced changes to remote-exec that mean Typhoon bare-metal clusters require multiple runs of terraform apply to ssh and bootstrap. * Bare-metal installs PXE boot a live instance to install to disk and then reboot from disk as controllers/workers. Terraform remote-exec has no way to "know" to wait until the reboot has occurred to kickoff Kubernetes bootstrap. Previously Typhoon created a "debug" user during this install phase to allow an admin to SSH, but remote-exec would hang, trying to connect as user "core". Terraform v0.11.4 changes this behavior so remote-exec fails and a user must re-run terraform apply until succeeding. * A new way to "trick" remote-exec into waiting for the reboot into the disk install is to run SSH on a non-standard port during the disk install. This retains the ability for an admin to SSH during install (most distros don't have this) and fixes the issue so only a single run of terraform apply is needed. * https://github.com/hashicorp/terraform/pull/17359#issuecomment-376415464
2018-04-05 06:38:03 +02:00
* Use `k8s.gcr.io` instead of `gcr.io/google_containers` ([#180](https://github.com/poseidon/typhoon/pull/180))
Use k8s.gcr.io instead of gcr.io/google_containers * Kubernetes recommends using the alias to fetch images from the nearest GCR regional mirror, to abstract the use of GCR, and to drop names containing 'google' * https://groups.google.com/forum/#!msg/kubernetes-dev/ytjk_rNrTa0/3EFUHvovCAAJ
2018-04-08 21:16:29 +02:00
* Kubernetes [recommends](https://groups.google.com/forum/#!msg/kubernetes-dev/ytjk_rNrTa0/3EFUHvovCAAJ) using the alias to pull from the nearest regional mirror and to abstract the backing container registry
Update etcd from v3.3.2 to v3.3.3 * https://github.com/coreos/etcd/releases/tag/v3.3.3
2018-04-05 05:32:24 +02:00
* Update etcd from v3.3.2 to v3.3.3
Add changelog notes for release
2018-04-29 21:04:44 +02:00
* Update kube-dns from v1.14.8 to v1.14.9
Update Kubernetes from v1.10.0 to v1.10.1 * Use kubernetes-incubator/bootkube v0.12.0
2018-04-13 05:23:35 +02:00
* Use kubernetes-incubator/bootkube v0.12.0
Add etcd metrics, Prometheus scrapes, and Grafana dash * Use etcd v3.3 --listen-metrics-urls to expose only metrics data via http://0.0.0.0:2381 on controllers * Add Prometheus discovery for etcd peers on controller nodes * Temporarily drop two noisy Prometheus alerts
2018-03-29 06:45:24 +02:00
Fix bare-metal multiple apply/ssh on Terraform v0.11.4+ * Terraform v0.11.4 introduced changes to remote-exec that mean Typhoon bare-metal clusters require multiple runs of terraform apply to ssh and bootstrap. * Bare-metal installs PXE boot a live instance to install to disk and then reboot from disk as controllers/workers. Terraform remote-exec has no way to "know" to wait until the reboot has occurred to kickoff Kubernetes bootstrap. Previously Typhoon created a "debug" user during this install phase to allow an admin to SSH, but remote-exec would hang, trying to connect as user "core". Terraform v0.11.4 changes this behavior so remote-exec fails and a user must re-run terraform apply until succeeding. * A new way to "trick" remote-exec into waiting for the reboot into the disk install is to run SSH on a non-standard port during the disk install. This retains the ability for an admin to SSH during install (most distros don't have this) and fixes the issue so only a single run of terraform apply is needed. * https://github.com/hashicorp/terraform/pull/17359#issuecomment-376415464
2018-04-05 06:38:03 +02:00
#### Bare-Metal
* Fix need for multiple `terraform apply` runs to create a cluster with Terraform v0.11.4 ([#181](https://github.com/poseidon/typhoon/pull/181))
* To SSH during a disk install for debugging, SSH as user "core" with port 2222
* Remove the old trick of using a user "debug" during disk install
Refactor GCP to remove controller internal module * Remove the controller internal module to align with other platforms and since its not a supported use case
2018-04-12 08:19:35 +02:00
#### Google Cloud
* Refactor out the `controller` internal module
Add etcd metrics, Prometheus scrapes, and Grafana dash * Use etcd v3.3 --listen-metrics-urls to expose only metrics data via http://0.0.0.0:2381 on controllers * Add Prometheus discovery for etcd peers on controller nodes * Temporarily drop two noisy Prometheus alerts
2018-03-29 06:45:24 +02:00
#### Addons
* Add Prometheus discovery for etcd peers on controller nodes ([#175](https://github.com/poseidon/typhoon/pull/175))
* Scrape etcd v3.3 `--listen-metrics-urls` for metrics
* Enable etcd alerts and populate the etcd Grafana dashboard
Update kube-state-metrics from v1.2.0 to v1.3.0 * https://github.com/kubernetes/kube-state-metrics/pull/412 * https://github.com/kubernetes/kube-state-metrics/pull/413
2018-04-05 06:04:13 +02:00
* Update kube-state-metrics from v1.2.0 to v1.3.0
Add etcd metrics, Prometheus scrapes, and Grafana dash * Use etcd v3.3 --listen-metrics-urls to expose only metrics data via http://0.0.0.0:2381 on controllers * Add Prometheus discovery for etcd peers on controller nodes * Temporarily drop two noisy Prometheus alerts
2018-03-29 06:45:24 +02:00
## v1.10.0
Update CHANGES.md with Kubernetes link
2018-03-31 08:12:38 +02:00
* Kubernetes [v1.10.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1100)
Remove unmaintained pxe-worker internal module
2018-03-26 06:56:55 +02:00
* Remove unused, unmaintained `pxe-worker` internal module
Add disk_type variable for EBS volume type on AWS * Change EBS volume type from `standard` ("prior generation) to `gp2`. Prometheus alerts are tuned for SSDs * Other platforms have fast enough disks by default
2018-03-29 09:24:07 +02:00
#### AWS
* Add `disk_type` optional variable for setting the EBS volume type ([#176](https://github.com/poseidon/typhoon/pull/176))
* Change default type from `standard` to `gp2`. Prometheus etcd alerts are tuned for fast disks.
Remove optional variable networking on Digital Ocean * Calico isn't viable on Digital Ocean because their firewalls do not support IP-IP protocol. Its not viable to run a cluster without firewalls just to use Calico. * Remove the caveat note. Don't allow users to shoot themselves in the foot
2018-03-26 06:48:08 +02:00
#### Digital Ocean
Ensure etcd secrets are only distributed to controller hosts * Previously, etcd secrets were erroneously distributed to worker nodes (permissions 500, ownership etc:etcd).
2018-03-26 07:32:09 +02:00
* Ensure etcd secrets are only distributed to controller hosts, not workers.
Add disk_type variable for EBS volume type on AWS * Change EBS volume type from `standard` ("prior generation) to `gp2`. Prometheus alerts are tuned for SSDs * Other platforms have fast enough disks by default
2018-03-29 09:24:07 +02:00
* Remove `networking` optional variable. Only flannel works on Digital Ocean.
Remove optional variable networking on Digital Ocean * Calico isn't viable on Digital Ocean because their firewalls do not support IP-IP protocol. Its not viable to run a cluster without firewalls just to use Calico. * Remove the caveat note. Don't allow users to shoot themselves in the foot
2018-03-26 06:48:08 +02:00
Add disk_size variable on Google Cloud
2018-03-26 07:04:14 +02:00
#### Google Cloud
Add disk_type variable for EBS volume type on AWS * Change EBS volume type from `standard` ("prior generation) to `gp2`. Prometheus alerts are tuned for SSDs * Other platforms have fast enough disks by default
2018-03-29 09:24:07 +02:00
* Add `disk_size` optional variable for setting instance disk size in GB
* Add `controller_type` optional variable for setting machine type for controllers
* Add `worker_type` optional variable for setting machine type for workers
* Remove `machine_type` optional variable. Use `controller_type` and `worker_type`.
Add disk_size variable on Google Cloud
2018-03-26 07:04:14 +02:00
addons: Update from Grafana v4.6.3 to v5.0.4 This reverts commit c59a9c66b1764cbd95df32f74af1dd66a3008450.
2018-03-29 04:12:39 +02:00
#### Addons
* Update Grafana from v4.6.3 to v5.0.4 ([#153](https://github.com/poseidon/typhoon/pull/153), [#174](https://github.com/poseidon/typhoon/pull/174))
* Restrict dashboard organization role to Viewer
Add v1.9.6 heading to CHANGES.md
2018-03-23 05:56:29 +01:00
## v1.9.6
Update Kubernetes from v1.9.5 to v1.9.6
2018-03-22 04:29:52 +01:00
* Kubernetes [v1.9.6](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v196)
* Update Calico from v3.0.3 to v3.0.4
addons: Update heapster from v1.5.1 to v1.5.2 * https://github.com/kubernetes/heapster/releases/tag/v1.5.2
2018-03-22 04:32:01 +01:00
#### Addons
* Update heapster from v1.5.1 to v1.5.2
Update nginx-ingress from 0.11.0 to 0.12.0
2018-03-20 07:15:57 +01:00
## v1.9.5
Update Kubernetes from v1.9.4 to v1.9.5
2018-03-19 01:50:14 +01:00
* Kubernetes [v1.9.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v195)
* Fix `subPath` volume mounts regression ([kubernetes#61076](https://github.com/kubernetes/kubernetes/issues/61076))
Improve changelog with migration links
2018-03-19 07:52:59 +01:00
* Introduce [Container Linux Config snippets](https://typhoon.psdn.io/advanced/customization/#container-linux) on cloud platforms ([#145](https://github.com/poseidon/typhoon/pull/145))
* Validate and additively merge custom Container Linux Configs during `terraform plan`
* Define files, systemd units, dropins, networkd configs, mounts, users, and more
* Require updating `terraform-provider-ct` plugin from v0.2.0 to v0.2.1
Mention controllers node label in changelog
2018-03-19 08:14:47 +01:00
* Add `node-role.kubernetes.io/controller="true"` node label to controllers ([#160](https://github.com/poseidon/typhoon/pull/160))
Improve changelog with migration links
2018-03-19 07:52:59 +01:00
#### AWS
Update links to Matchbox, terraform-provider-ct, etc. * Matchbox, terraform-provider-matchbox, and terraform-provider-ct have moved to the poseidon Github organization
2019-05-04 19:46:07 +02:00
* [Require](https://typhoon.psdn.io/topics/maintenance/#terraform-provider-ct-v021) updating `terraform-provider-ct` plugin from v0.2.0 to [v0.2.1](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.2.1) (action required!)
Improve changelog with migration links
2018-03-19 07:52:59 +01:00
#### Digital Ocean
Update links to Matchbox, terraform-provider-ct, etc. * Matchbox, terraform-provider-matchbox, and terraform-provider-ct have moved to the poseidon Github organization
2019-05-04 19:46:07 +02:00
* [Require](https://typhoon.psdn.io/topics/maintenance/#terraform-provider-ct-v021) updating `terraform-provider-ct` plugin from v0.2.0 to [v0.2.1](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.2.1) (action required!)
Improve changelog with migration links
2018-03-19 07:52:59 +01:00
#### Google Cloud
Update links to Matchbox, terraform-provider-ct, etc. * Matchbox, terraform-provider-matchbox, and terraform-provider-ct have moved to the poseidon Github organization
2019-05-04 19:46:07 +02:00
* [Require](https://typhoon.psdn.io/topics/maintenance/#terraform-provider-ct-v021) updating `terraform-provider-ct` plugin from v0.2.0 to [v0.2.1](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.2.1) (action required!)
Set default Google Cloud os_image to coreos-stable
2018-03-19 08:06:37 +01:00
* Relax `os_image` to optional. Default to "coreos-stable".
Improve changelog with migration links
2018-03-19 07:52:59 +01:00
Update Prometheus from 2.2.0 to 2.2.1
2018-03-18 23:55:42 +01:00
#### Addons
Update nginx-ingress from 0.11.0 to 0.12.0
2018-03-20 07:15:57 +01:00
* Update nginx-ingress from 0.11.0 to 0.12.0
Update Prometheus from 2.2.0 to 2.2.1
2018-03-18 23:55:42 +01:00
* Update Prometheus from 2.2.0 to 2.2.1
Improve changelog, README, and index page
2018-03-13 04:55:35 +01:00
## v1.9.4
Update Kubernetes from v1.9.3 to v1.9.4
2018-03-11 21:15:35 +01:00
* Kubernetes [v1.9.4](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v194)
Add clarifying links to CHANGES
2018-03-13 05:19:15 +01:00
* Secret, configMap, downward API, and projected volumes now read-only (breaking, [kubernetes#58720](https://github.com/kubernetes/kubernetes/pull/58720))
Add links to upstream regressions
2018-03-15 02:54:22 +01:00
* Regressed `subPath` volume mounts (regression, [kubernetes#61076](https://github.com/kubernetes/kubernetes/issues/61076))
Add clarifying links to CHANGES
2018-03-13 05:19:15 +01:00
* Mitigated `subPath` [CVE-2017-1002101](https://github.com/kubernetes/kubernetes/issues/60813)
Improve changelog, README, and index page
2018-03-13 04:55:35 +01:00
* Introduce [worker pools](https://typhoon.psdn.io/advanced/worker-pools/) for AWS and Google Cloud for joining heterogeneous workers to existing clusters.
Add details and links to the changelog
2018-03-12 01:05:55 +01:00
* Use new Network Load Balancers and cross zone load balancing on AWS
Update Kubernetes from v1.9.3 to v1.9.4
2018-03-11 21:15:35 +01:00
* Allow flexvolume plugins to be used on any Typhoon cluster (not just bare-metal)
Update etcd from v3.3.1 to v3.3.2 * https://github.com/coreos/etcd/releases/tag/v3.3.2
2018-03-09 09:43:15 +01:00
* Upgrade etcd from v3.2.15 to v3.3.2
Update Calico from v3.0.2 to v3.0.3 * https://github.com/projectcalico/calico/releases/tag/v3.0.3
2018-02-25 04:16:20 +01:00
* Update Calico from v3.0.2 to v3.0.3
Update Kubernetes from v1.10.0 to v1.10.1 * Use kubernetes-incubator/bootkube v0.12.0
2018-04-13 05:23:35 +02:00
* Use kubernetes-incubator/bootkube v0.11.0
Update links to Matchbox, terraform-provider-ct, etc. * Matchbox, terraform-provider-matchbox, and terraform-provider-ct have moved to the poseidon Github organization
2019-05-04 19:46:07 +02:00
* [Recommend](https://typhoon.psdn.io/topics/maintenance/#terraform-provider-ct-v021) updating `terraform-provider-ct` plugin from v0.2.0 to [v0.2.1](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.2.1) (action recommended)
Upgrade etcd from v3.2.15 to v3.3.1
2018-02-16 04:29:17 +01:00
addons: Update nginx-ingress from 0.10.2 to 0.11.0
2018-02-22 08:45:50 +01:00
#### AWS
Promote AWS platform from beta to stable
2018-03-13 05:15:53 +01:00
* Promote AWS platform to stable
Add details and links to the changelog
2018-03-12 01:05:55 +01:00
* Allow groups of workers to be defined and joined to a cluster (i.e. worker pools) ([#150](https://github.com/poseidon/typhoon/pull/150))
* Replace the apiserver elastic load balancer with a network load balancer ([#136](https://github.com/poseidon/typhoon/pull/136))
* Replace the Ingress elastic load balancer with a network load balancer ([#141](https://github.com/poseidon/typhoon/pull/141))
Improve links in tutorials and changelog notes
2018-02-26 21:55:32 +01:00
* AWS [NLBs](https://aws.amazon.com/blogs/aws/new-network-load-balancer-effortless-scaling-to-millions-of-requests-per-second/) can handle millions of RPS with high throughput and low latency.
Add details and links to the changelog
2018-03-12 01:05:55 +01:00
* Require `terraform-provider-aws` 1.7.0 or higher
Improve changelog, README, and index page
2018-03-13 04:55:35 +01:00
* Enable NLB [cross-zone](https://aws.amazon.com/about-aws/whats-new/2018/02/network-load-balancer-now-supports-cross-zone-load-balancing/) load balancing ([#159](https://github.com/poseidon/typhoon/pull/159))
* Requests are automatically evenly distributed to targets regardless of AZ
Add details and links to the changelog
2018-03-12 01:05:55 +01:00
* Require `terraform-provider-aws` 1.11.0 or higher
Add kubelet --volume-plugin-dir flag * Set Kubelet search path for flexvolume plugins to /var/lib/kubelet/volumeplugins * Add support for flexvolume plugins on AWS, GCE, and DO * See 9548572d982 which added flexvolume support for bare-metal
2018-02-23 07:00:51 +01:00
* Add kubelet `--volume-plugin-dir` flag to allow flexvolume plugins ([#142](https://github.com/poseidon/typhoon/pull/142))
Add ignore_changes for AWS worker image_id
2018-03-10 22:13:48 +01:00
* Fix controller and worker launch configs to ignore AMI changes ([#126](https://github.com/poseidon/typhoon/pull/126), [#158](https://github.com/poseidon/typhoon/pull/158))
Add kubelet --volume-plugin-dir flag * Set Kubelet search path for flexvolume plugins to /var/lib/kubelet/volumeplugins * Add support for flexvolume plugins on AWS, GCE, and DO * See 9548572d982 which added flexvolume support for bare-metal
2018-02-23 07:00:51 +01:00
#### Digital Ocean
* Add kubelet `--volume-plugin-dir` flag to allow flexvolume plugins ([#142](https://github.com/poseidon/typhoon/pull/142))
Pass Digital Ocean ssh_fingerprints as a list * Fix digital-ocean module to pass ssh_fingerprints as a list since the module accepts a list
2018-02-25 01:22:57 +01:00
* Fix to pass `ssh_fingerprints` as a list to droplets ([#143](https://github.com/poseidon/typhoon/pull/143))
Add kubelet --volume-plugin-dir flag * Set Kubelet search path for flexvolume plugins to /var/lib/kubelet/volumeplugins * Add support for flexvolume plugins on AWS, GCE, and DO * See 9548572d982 which added flexvolume support for bare-metal
2018-02-23 07:00:51 +01:00
#### Google Cloud
Add support for worker pools on AWS * Allow groups of workers to be defined and joined to a cluster (i.e. worker pools) * Move worker resources into a Terraform submodule * Output variables needed for passing to worker pools * Add usage docs for AWS worker pools (advanced)
2018-02-27 07:16:34 +01:00
* Allow groups of workers to be defined and joined to a cluster (i.e. worker pools) ([#148](https://github.com/poseidon/typhoon/pull/148))
Add kubelet --volume-plugin-dir flag * Set Kubelet search path for flexvolume plugins to /var/lib/kubelet/volumeplugins * Add support for flexvolume plugins on AWS, GCE, and DO * See 9548572d982 which added flexvolume support for bare-metal
2018-02-23 07:00:51 +01:00
* Add kubelet `--volume-plugin-dir` flag to allow flexvolume plugins ([#142](https://github.com/poseidon/typhoon/pull/142))
Simplify CLC kubeconfig templating on AWS and GCP * Template terraform-render-bootkube's multi-line kubeconfig output using the right indentation * Add `kubeconfig` variable to google-cloud controllers and workers Terraform submodules * Remove `kubeconfig_*` variables from google-cloud controllers and workers Terraform submodules
2018-02-26 21:17:42 +01:00
* Add `kubeconfig` variable to `controllers` and `workers` submodules ([#147](https://github.com/poseidon/typhoon/pull/147))
* Remove `kubeconfig_*` variables from `controllers` and `workers` submodules ([#147](https://github.com/poseidon/typhoon/pull/147))
Allow Google accelerators (i.e. GPUs) on workers
2018-03-03 02:26:51 +01:00
* Allow initial experimentation with accelerators (i.e. GPUs) on workers ([#161](https://github.com/poseidon/typhoon/pull/161)) (unofficial)
* Require `terraform-provider-google` v1.6.0
addons: Update Heapster from v1.5.0 to v1.5.1 * Switch to k8s.gcr.io vanity image name * Add service account, Role, and ClusterRole for heapster
2018-02-11 19:45:39 +01:00
List addons below platforms in CHANGES
2018-02-23 07:33:13 +01:00
#### Addons
Update CHANGES.md changelog with monitoring updates
2018-03-03 06:59:19 +01:00
* Update Prometheus from 2.1.0 to 2.2.0 ([#153](https://github.com/poseidon/typhoon/pull/153))
Add details and links to the changelog
2018-03-12 01:05:55 +01:00
* Scrape Prometheus itself to enable alerts about Prometheus itself
* Adjust KubeletDown rule to fire when 10% of kubelets are down
List addons below platforms in CHANGES
2018-02-23 07:33:13 +01:00
* Update heapster from v1.5.0 to v1.5.1 ([#131](https://github.com/poseidon/typhoon/pull/131))
* Use separate service account
* Update nginx-ingress from 0.10.2 to 0.11.0
Update CHANGELOG.md for v1.9.3
2018-02-11 19:59:16 +01:00
## v1.9.3
Update Kubernetes from v1.9.2 to v1.9.3 * Add flannel service account and limited RBAC cluster role * Change DaemonSets to tolerate NoSchedule and NoExecute taints * Remove deprecated apiserver --etcd-quorum-read flag * Update Calico from v3.0.1 to v3.0.2 * Add Calico GlobalNetworkSet CRD * https://github.com/poseidon/terraform-render-bootkube/pull/44
2018-02-10 21:49:34 +01:00
* Kubernetes [v1.9.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v193)
Update CHANGELOG.md for v1.9.3
2018-02-11 19:59:16 +01:00
* Network improvements and fixes ([#104](https://github.com/poseidon/typhoon/pull/104))
Update Kubernetes from v1.9.2 to v1.9.3 * Add flannel service account and limited RBAC cluster role * Change DaemonSets to tolerate NoSchedule and NoExecute taints * Remove deprecated apiserver --etcd-quorum-read flag * Update Calico from v3.0.1 to v3.0.2 * Add Calico GlobalNetworkSet CRD * https://github.com/poseidon/terraform-render-bootkube/pull/44
2018-02-10 21:49:34 +01:00
* Switch from Calico v2.6.6 to v3.0.2
* Add Calico GlobalNetworkSet CRD
Update flannel from v0.9.0 to v0.10.0 * https://github.com/coreos/flannel/releases/tag/v0.10.0
2018-01-29 08:09:21 +01:00
* Update flannel from v0.9.0 to v0.10.0
Update Kubernetes from v1.9.2 to v1.9.3 * Add flannel service account and limited RBAC cluster role * Change DaemonSets to tolerate NoSchedule and NoExecute taints * Remove deprecated apiserver --etcd-quorum-read flag * Update Calico from v3.0.1 to v3.0.2 * Add Calico GlobalNetworkSet CRD * https://github.com/poseidon/terraform-render-bootkube/pull/44
2018-02-10 21:49:34 +01:00
* Use separate service account for flannel
Update flannel from v0.9.0 to v0.10.0 * https://github.com/coreos/flannel/releases/tag/v0.10.0
2018-01-29 08:09:21 +01:00
* Update etcd from v3.2.14 to v3.2.15
Update etcd from 3.2.14 to 3.2.15 * https://github.com/coreos/etcd/releases/tag/v3.2.15
2018-01-24 08:50:04 +01:00
List addons below platforms in CHANGES
2018-02-23 07:33:13 +01:00
#### Digital Ocean
* Use new Droplet [types](https://developers.digitalocean.com/documentation/changelog/api-v2/new-size-slugs-for-droplet-plan-changes/) which offer more CPU/memory, at lower cost. ([#105](https://github.com/poseidon/typhoon/pull/105))
* A small Digital Ocean cluster costs less than $25 a month!
Update changelog with recent addon improvements
2018-01-28 10:24:27 +01:00
#### Addons
Update CHANGELOG.md for v1.9.3
2018-02-11 19:59:16 +01:00
* Update Prometheus from v2.0.0 to v2.1.0 ([#113](https://github.com/poseidon/typhoon/pull/113))
Update changelog with recent addon improvements
2018-01-28 10:24:27 +01:00
* Improve alerting rules
* Relabel discovered kubelet, endpoint, service, and apiserver scrapes
* Use separate service accounts
* Update node-exporter and kube-state-metrics
Update CHANGELOG.md for v1.9.3
2018-02-11 19:59:16 +01:00
* Include Grafana dashboards for Kubernetes admins ([#113](https://github.com/poseidon/typhoon/pull/113))
Update changelog with recent addon improvements
2018-01-28 10:24:27 +01:00
* Add grafana-watcher to load bundled upstream dashboards
* Update nginx-ingress from 0.9.0 to 0.10.2
addons: Switch to apps/v1 workload APIs * Deployments now belong to the apps/v1 API group * DaemonSets now belong to the apps/v1 API group * RBAC types now belong to the rbac.authorization.k8s.io/v1 API group
2018-02-11 08:51:55 +01:00
* Update CLUO from v0.5.0 to v0.6.0
Update CHANGELOG.md for v1.9.3
2018-02-11 19:59:16 +01:00
* Switch manifests to use `apps/v1` Deployments and Daemonsets ([#120](https://github.com/poseidon/typhoon/pull/120))
addons: Remove Kubernetes Dashboard manifests and docs * Stop maintaining Kubernetes Dashboard manifests. Dashboard takes an unusual approch to security and is often a security weak point. * Recommendation: Use `kubectl` and avoid using the dashboard. If you must use the dashboard, explore hardening and consider using an authenticating proxy rather than the dashboard's auth features
2018-02-11 19:19:09 +01:00
* Remove Kubernetes Dashboard manifests ([#121](https://github.com/poseidon/typhoon/pull/121))
Update changelog with recent addon improvements
2018-01-28 10:24:27 +01:00
Update Kubernetes from v1.9.1 to v1.9.2
2018-01-19 17:40:09 +01:00
## v1.9.2
* Kubernetes [v1.9.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v192)
Add Terraform v0.11.x support and migration docs * Add explicit "providers" section to modules for Terraform v0.11.x * Retain support for Terraform v0.10.4+ * Add migration guide from Terraform v0.10.x to v0.11.x for those managing existing clusters (action required!)
2018-01-12 15:56:08 +01:00
* Add Terraform v0.11.x support
* Add explicit "providers" section to modules for Terraform v0.11.x
* Retain support for Terraform v0.10.4+
Improve links in tutorials and changelog notes
2018-02-26 21:55:32 +01:00
* Add [migration guide](https://typhoon.psdn.io/topics/maintenance/#terraform-v011x) from Terraform v0.10.x to v0.11.x (**action required!**)
Update etcd from 3.2.13 to 3.2.14 * https://github.com/coreos/etcd/releases/tag/v3.2.14
2018-01-12 16:19:56 +01:00
* Update etcd from 3.2.13 to 3.2.14
Update bootkube and terraform-render-bootkube to v0.10.0
2018-01-20 08:10:45 +01:00
* Update calico from 2.6.5 to 2.6.6
Update kube-dns and use separate service account * Update kube-dns from v1.14.7 to v1.14.8 * Use a separate kube-dns service account * https://github.com/kubernetes/kubernetes/pull/57918
2018-01-12 17:12:18 +01:00
* Update kube-dns from v1.14.7 to v1.14.8
* Use separate service account for kube-dns
Update bootkube and terraform-render-bootkube to v0.10.0
2018-01-20 08:10:45 +01:00
* Use kubernetes-incubator/bootkube v0.10.0
Update etcd from 3.2.13 to 3.2.14 * https://github.com/coreos/etcd/releases/tag/v3.2.14
2018-01-12 16:19:56 +01:00
Create separate bare-metal container-linux-install profiles * Create separate container-linux-install profiles (and cached-container-linux-install) for each node in a cluster * Fix contention bug on bare-metal during `terraform apply`. With only a global install profile, terraform would create (or retain) the profile for each cluster and try to delete it for each cluster being deleted. As a result, in some cases apply had to be run multiple times before terraform's repr of constraints was satisfied (profile deleted and recreated) * Allow Container Linux install properties to vary between clusters, such as using a different Container Linux channel or version for different clusters
2018-01-14 21:36:40 +01:00
#### Bare-Metal
* Use per-node Container Linux install profiles ([#97](https://github.com/poseidon/typhoon/pull/97))
* Allow Container Linux channel/version to be chosen per-cluster
* Fix issue where cluster deletion could require `terraform apply` multiple times
Relax digitalocean provider version constraints * Relax fixed 0.1.2 version constraint to "~> 0.1.2", which allows 0.1.3, 0.1.4, etc, but would not allow 0.2.0
2018-01-16 05:57:55 +01:00
#### Digital Ocean
* Relax `digitalocean` provider version constraint
Add missing changelog entry for Digital Ocean fix
2018-01-20 16:52:40 +01:00
* Fix bug with `terraform plan` always showing a firewall diff to be applied ([#3](https://github.com/poseidon/typhoon/issues/3))
Relax digitalocean provider version constraints * Relax fixed 0.1.2 version constraint to "~> 0.1.2", which allows 0.1.3, 0.1.4, etc, but would not allow 0.2.0
2018-01-16 05:57:55 +01:00
List addons below platforms in CHANGES
2018-02-23 07:33:13 +01:00
#### Addons
* Update CLUO to v0.5.0 to fix compatibility with Kubernetes 1.9 (**important**)
* Earlier versions can't roll out Container Linux updates on Kubernetes 1.9 nodes ([cluo#163](https://github.com/coreos/container-linux-update-operator/issues/163))
* Update kube-state-metrics from v1.1.0 to v1.2.0
* Fix RBAC cluster role for kube-state-metrics
Update etcd from 3.2.13 to 3.2.14 * https://github.com/coreos/etcd/releases/tag/v3.2.14
2018-01-12 16:19:56 +01:00
## v1.9.1
Update Kubernetes from v1.8.6 to v1.9.1
2017-12-21 23:06:38 +01:00
* Kubernetes [v1.9.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v191)
Update CHANGELOG.md for v1.9.1
2018-01-09 16:03:04 +01:00
* Update kube-dns from 1.14.5 to v1.14.7
* Update etcd from 3.2.0 to 3.2.13
* Update Calico from v2.6.4 to v2.6.5
* Enable portmap to fix hostPort with Calico
Update kube-dns and use separate service account * Update kube-dns from v1.14.7 to v1.14.8 * Use a separate kube-dns service account * https://github.com/kubernetes/kubernetes/pull/57918
2018-01-12 17:12:18 +01:00
* Use separate service account for controller-manager
Update Kubernetes from v1.8.6 to v1.9.1
2017-12-21 23:06:38 +01:00
Update CHANGELOG.md for v1.8.6
2017-12-22 22:00:18 +01:00
## v1.8.6
Update Kubernetes from v1.8.5 to v1.8.6
2017-12-21 19:30:13 +01:00
* Kubernetes [v1.8.6](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.8.md#v186)
Update CHANGELOG.md for v1.9.1
2018-01-09 16:03:04 +01:00
* Update Calico from v2.6.3 to v2.6.4
Update Kubernetes from v1.8.5 to v1.8.6
2017-12-21 19:30:13 +01:00
Update CHANGELOG.md for v1.8.5
2017-12-15 10:52:51 +01:00
## v1.8.5
Add Kubernetes Dashboard warning and improve changelog
2017-12-10 07:38:27 +01:00
* Kubernetes [v1.8.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.8.md#v185)
* Recommend Container Linux [images](https://coreos.com/releases/) with Docker 17.09
Recommend Container Linux images with Docker 17.09 * Container Linux stable and beta now provide Docker 17.09 (instead of 1.12). Recommend images which provide 17.09. * Older clusters (with CLUO addon) auto-update node's Container Linux version and will begin using Docker 17.09.
2017-12-10 07:02:45 +01:00
* Container Linux stable, beta, and alpha now provide Docker 17.09 (instead
Update CHANGELOG.md for v1.8.5
2017-12-15 10:52:51 +01:00
of 1.12)
* Older clusters (with CLUO addon) auto-update Container Linux version to begin using Docker 17.09
Update bare-metal Fedora CoreOS image location * Use Fedora CoreOS production download streams (change) * Use live PXE kernel and initramfs images * https://getfedora.org/coreos/download/ * Update docs example to use public images (cache is still recommended at large scale) and stable stream
2020-01-14 09:49:34 +01:00
* Fix race where `etcd-member.service` could fail to resolve peers ([#69](https://github.com/poseidon/typhoon/pull/69))
Update CHANGELOG.md for v1.8.5
2017-12-15 10:52:51 +01:00
* Add optional `cluster_domain_suffix` variable (#74)
Update bootkube and terraform-render-bootkube to v0.9.1
2017-12-15 10:45:02 +01:00
* Use kubernetes-incubator/bootkube v0.9.1
Add Kubernetes Dashboard warning and improve changelog
2017-12-10 07:38:27 +01:00
#### Bare-Metal
* Add kubelet `--volume-plugin-dir` flag to allow flexvolume providers ([#61](https://github.com/poseidon/typhoon/pull/61))
#### Addons
Update CHANGELOG.md for v1.8.5
2017-12-15 10:52:51 +01:00
* Discourage deploying the Kubernetes Dashboard (security)
Update Kubernetes from v1.8.4 to v1.8.5
2017-12-08 17:56:53 +01:00
Update bootkube and terraform-render-bootkube to v0.9.0
2017-12-02 07:27:48 +01:00
## v1.8.4
Update Kubernetes from v1.8.3 to v1.8.4
2017-11-29 06:52:11 +01:00
* Kubernetes v1.8.4
* Calico related bug fixes
* Update Calico from v2.6.1 to v2.6.3
* Update flannel from v0.9.0 to v0.9.1
Update bootkube and terraform-render-bootkube to v0.9.0
2017-12-02 07:27:48 +01:00
* Service accounts for kube-proxy and pod-checkpointer
* Use kubernetes-incubator/bootkube v0.9.0
Update Kubernetes from v1.8.3 to v1.8.4
2017-11-29 06:52:11 +01:00
addons: Add better alerting rules to Prometheus manifests * Adapt the coreos/prometheus-operator alerting rules for Typhoon, https://github.com/coreos/prometheus-operator/tree/master/contrib/kube-prometheus/manifests * Add controller manager and scheduler shim services to let prometheus discover them via service endpoints * Fix several alert rules to use service endpoint discovery * A few rules still don't do much, but they default to green
2017-11-08 10:35:56 +01:00
## v1.8.3
Update Kubernetes from v1.8.2 to v1.8.3
2017-11-09 07:41:01 +01:00
* Kubernetes v1.8.3
Update bootkube and terraform-render-bootkube to v0.8.2
2017-11-11 05:01:37 +01:00
* Run etcd on-host, across controllers
* Promote AWS platform to beta
* Use kubernetes-incubator/bootkube v0.8.2
Promote AWS platform from alpha to beta
2017-11-07 06:19:11 +01:00
Change worker managed instance group to span zones in region * Change Google Cloud module to require the `region` variable * Workers are created in random zones within the given region * Tolerate Google Cloud zone failures or capacity issues * If workers are preempted (if enabled), replacement instances can be drawn from any zone in the region, which should avoid scheduling issues that were possible before if a single zone aggressively preempts instances (presumably due to Google Cloud capacity)
2017-11-04 18:57:12 +01:00
#### Google Cloud
Remove controller_preemptible option on Google Cloud * Controller preemption is not safe or covered in documentation. Delete the option, the variable is a holdover from old experiments * Note, worker_preemeptible is still a great feature that's supported
2017-11-04 19:48:50 +01:00
* Add required variable `region` (e.g. "us-central1")
Run etcd cluster on-host, across controllers on Google Cloud * Change controllers from a managed group to individual instances * Create discrete DNS records to each controller's private IP for etcd * Change etcd to run on-host, across controllers (etcd-member.service) * Reduce time to bootstrap a cluster * Deprecate self-hosted-etcd on the Google Cloud platform
2017-11-05 20:01:50 +01:00
* Reduce time to bootstrap a cluster
* Change etcd to run on-host, across controllers (etcd-member.service)
Create controller instances across zones in the region * Change controller instances to automatically span zones in a region * Remove the `zone` required variable
2017-11-05 20:09:03 +01:00
* Change controller instances to automatically span zones in the region
* Change worker managed instance group to automatically span zones in the region
Improve internal firewall rules on Google Cloud * Whitelist internal traffic between controllers and workers * Switch to tag-based firewall policies rather than source IP
2017-11-08 08:21:12 +01:00
* Improve internal firewall rules and use tag-based firewall policies
Run etcd cluster on-host, across controllers on Google Cloud * Change controllers from a managed group to individual instances * Create discrete DNS records to each controller's private IP for etcd * Change etcd to run on-host, across controllers (etcd-member.service) * Reduce time to bootstrap a cluster * Deprecate self-hosted-etcd on the Google Cloud platform
2017-11-05 20:01:50 +01:00
* Remove support for self-hosted etcd
Create controller instances across zones in the region * Change controller instances to automatically span zones in a region * Remove the `zone` required variable
2017-11-05 20:09:03 +01:00
* Remove the `zone` required variable
* Remove the `controller_preemptible` optional variable
Change worker managed instance group to span zones in region * Change Google Cloud module to require the `region` variable * Workers are created in random zones within the given region * Tolerate Google Cloud zone failures or capacity issues * If workers are preempted (if enabled), replacement instances can be drawn from any zone in the region, which should avoid scheduling issues that were possible before if a single zone aggressively preempts instances (presumably due to Google Cloud capacity)
2017-11-04 18:57:12 +01:00
Run etcd cluster on-host, across controllers on AWS * Change controllers ASG to heterogeneous EC2 instances * Create DNS records for each controller's private IP for etcd * Change etcd to run on-host, across controllers (etcd-member.service) * Reduce time to bootstrap a cluster * Deprecate self-hosted-etcd on the AWS platform
2017-11-06 07:36:50 +01:00
#### AWS
Promote AWS platform from alpha to beta
2017-11-07 06:19:11 +01:00
* Promote AWS platform to beta
Run etcd cluster on-host, across controllers on AWS * Change controllers ASG to heterogeneous EC2 instances * Create DNS records for each controller's private IP for etcd * Change etcd to run on-host, across controllers (etcd-member.service) * Reduce time to bootstrap a cluster * Deprecate self-hosted-etcd on the AWS platform
2017-11-06 07:36:50 +01:00
* Reduce time to bootstrap a cluster
* Change etcd to run on-host, across controllers (etcd-member.service)
Promote AWS platform from alpha to beta
2017-11-07 06:19:11 +01:00
* Fix firewall rules for multi-controller kubelet scraping and node-exporter
Run etcd cluster on-host, across controllers on AWS * Change controllers ASG to heterogeneous EC2 instances * Create DNS records for each controller's private IP for etcd * Change etcd to run on-host, across controllers (etcd-member.service) * Reduce time to bootstrap a cluster * Deprecate self-hosted-etcd on the AWS platform
2017-11-06 07:36:50 +01:00
* Remove support for self-hosted etcd
addons: Add better alerting rules to Prometheus manifests * Adapt the coreos/prometheus-operator alerting rules for Typhoon, https://github.com/coreos/prometheus-operator/tree/master/contrib/kube-prometheus/manifests * Add controller manager and scheduler shim services to let prometheus discover them via service endpoints * Fix several alert rules to use service endpoint discovery * A few rules still don't do much, but they default to green
2017-11-08 10:35:56 +01:00
#### Addons
* Add Prometheus 2.0 addon with alerting rules
* Add Grafana dashboard for observing metrics
Update Kubernetes from v1.8.1 to v1.8.2 * Kubernetes v1.8.2 fixes a memory leak in the v1.8.1 apiserver * Switch to using the `gcr.io/google_containers/hyperkube` for the on-host kubelet and shutdown drains * Update terraform-render-bootkube manifests generation * Update flannel from v0.8.0 to v0.9.0 * Add `hairpinMode` to flannel CNI config * Add `--no-negcache` to kube-dns dnsmasq
2017-10-25 06:34:29 +02:00
## v1.8.2
* Kubernetes v1.8.2
* Fixes a memory leak in the v1.8.1 apiserver ([kubernetes#53485](https://github.com/kubernetes/kubernetes/issues/53485))
* Switch to using the `gcr.io/google_containers/hyperkube`
* Update flannel from v0.8.0 to v0.9.0
* Add `hairpinMode` to flannel CNI config
* Add `--no-negcache` to kube-dns dnsmasq
Bump bootkube and terraform-render-bootkube to v0.8.1 * Use the v0.8.1 tagged terraform-render-bootkube module * Use the v0.8.1 quay.io/coreos/bootkube image to bootstrap
2017-10-28 21:50:37 +02:00
* Use kubernetes-incubator/bootkube v0.8.1
Update Kubernetes from v1.8.1 to v1.8.2 * Kubernetes v1.8.2 fixes a memory leak in the v1.8.1 apiserver * Switch to using the `gcr.io/google_containers/hyperkube` for the on-host kubelet and shutdown drains * Update terraform-render-bootkube manifests generation * Update flannel from v0.8.0 to v0.9.0 * Add `hairpinMode` to flannel CNI config * Add `--no-negcache` to kube-dns dnsmasq
2017-10-25 06:34:29 +02:00
Update AWS, DO, BM Kubernetes from v1.7.7 to v1.8.1 * Update from bootkube v0.7.0 to v0.8.0 * Leave Google Cloud update to a followup commit
2017-10-09 08:49:29 +02:00
## v1.8.1
* Kubernetes v1.8.1
* Use kubernetes-incubator/bootkube v0.8.0
digital-ocean: Run etcd cluster on-host, across controllers * Run etcd peers with TLS across controller nodes * Deprecate self-hosted-etcd on the Digital Ocean platform * Distribute etcd TLS certificates as part of initial provisioning * Check the status of etcd by running `systemctl status etcd-member`
2017-10-04 09:07:48 +02:00
#### Digital Ocean
* Run etcd cluster across controller nodes (etcd-member.service)
* Remove support for self-hosted etcd
Update AWS, DO, BM Kubernetes from v1.7.7 to v1.8.1 * Update from bootkube v0.7.0 to v0.8.0 * Leave Google Cloud update to a followup commit
2017-10-09 08:49:29 +02:00
* Reduce time to bootstrap a cluster
digital-ocean: Run etcd cluster on-host, across controllers * Run etcd peers with TLS across controller nodes * Deprecate self-hosted-etcd on the Digital Ocean platform * Distribute etcd TLS certificates as part of initial provisioning * Check the status of etcd by running `systemctl status etcd-member`
2017-10-04 09:07:48 +02:00
Update Kubernetes from v1.7.5 to v1.7.7 * Update from bootkube v0.6.2 to v0.7.0 * Use renamed terraform-render-bootkube. Renamed from bootkube-terraform to meet Terraform Module requirements
2017-10-04 05:48:24 +02:00
## v1.7.7
* Kubernetes v1.7.7
* Use kubernetes-incubator/bootkube v0.7.0
* Update kube-dns to 1.14.5 to fix dnsmasq [vulnerability](https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html)
* Calico v2.6.1
* flannel-cni v0.3.0
* Update flannel CNI config to fix hostPort
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
## v1.7.5
* Kubernetes v1.7.5
Update Kubernetes from v1.7.5 to v1.7.7 * Update from bootkube v0.6.2 to v0.7.0 * Use renamed terraform-render-bootkube. Renamed from bootkube-terraform to meet Terraform Module requirements
2017-10-04 05:48:24 +02:00
* Use kubernetes-incubator/bootkube v0.6.2
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
* Add AWS Terraform module (alpha)
* Add support for Calico networking (bare-metal, Google Cloud, AWS)
* Change networking default from "flannel" to "calico"
#### AWS
* Add `network_mtu` to allow CNI interface MTU customization
#### Bare-Metal
* Add `network_mtu` to allow CNI interface MTU customization
bare-metal: Remove support for experimental_self_hosted_etcd * Transition from discouraging self-hosted etcd for bare-metal, to removing it as an option * See #13 and FAQ for self-hosted etcd discussion
2017-09-23 21:52:50 +02:00
* Remove support for `experimental_self_hosted_etcd`
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
## v1.7.3
* Kubernetes v1.7.3
Fix typos in docs and CONTRIBUTING.md
2017-12-09 18:26:26 +01:00
* Use kubernetes-incubator/bootkube v0.6.1
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
#### Digital Ocean
* Add cloud firewall rules (requires Terraform v0.10)
* Change nodes tags from strings to DO tags
## v1.7.1
* Kubernetes v1.7.1
Fix typos in docs and CONTRIBUTING.md
2017-12-09 18:26:26 +01:00
* Use kubernetes-incubator/bootkube v0.6.0
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
* Add Bare-Metal Terraform module (stable)
* Add Digital Ocean Terraform module (beta)
#### Google Cloud
* Remove `k8s_domain_name` variable, `cluster_name` + `dns_zone` resolves to controllers
* Rename `dns_base_zone` to `dns_zone`
* Rename `dns_base_zone_name` to `dns_zone_name`
## v1.6.7
* Kubernetes v1.6.7
Fix typos in docs and CONTRIBUTING.md
2017-12-09 18:26:26 +01:00
* Use kubernetes-incubator/bootkube v0.5.1
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
## v1.6.6
* Kubernetes v1.6.6
Fix typos in docs and CONTRIBUTING.md
2017-12-09 18:26:26 +01:00
* Use kubernetes-incubator/bootkube v0.4.5
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
* Disable locksmithd on hosts, in favor of [CLUO](https://github.com/coreos/container-linux-update-operator).
## v1.6.4
* Kubernetes v1.6.4
* Add Google Cloud Terraform module (stable)
## Earlier
Earlier versions, back to v1.3.0, used different designs and mechanisms.