CadolesKube
/
typhoon
mirror of https://github.com/puppetmaster/typhoon.git
7
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
typhoon/CHANGES.md

1038 lines
52 KiB
Markdown
Raw Normal View History

README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
# Typhoon
Notable changes between versions.
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
## Latest
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
Upgrade Calico from v3.7.4 to v3.8.0 * Enable CNI bandwidth plugin for traffic shaping * https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#support-traffic-shaping
2019-07-12 06:00:03 +02:00
* Upgrade Calico from v3.7.3 to [v3.8.0](https://docs.projectcalico.org/v3.8/release-notes/)
* Enable CNI `bandwidth` plugin for [traffic shaping](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#support-traffic-shaping)
Run kube-apiserver with lower privilege user (nobody) * Run kube-apiserver as a non-root user (nobody). User no longer needs to bind low number ports. * On most platforms, the kube-apiserver load balancer listens on 6443 and fronts controllers with kube-apiserver pods using port 6443. Google Cloud TCP proxy load balancers cannot listen on 6443. However, GCP's load balancer can be made to listen on 443, while kube-apiserver uses 6443 across all platforms.
2019-07-06 22:11:37 +02:00
* Run `kube-apiserver` with lower privilege user (nobody) ([#506](https://github.com/poseidon/typhoon/pull/506))
Relax terraform-provider-ct version constraint * Allow updating terraform-provider-ct to any release beyond v0.3.2, but below v1.0. This relaxes the prior constraint that allowed only v0.3.y provider versions
2019-07-17 07:04:00 +02:00
* Relax `terraform-provider-ct` version constraint (v0.3.2+)
* Allow provider versions below v1.0.0 (e.g. upgrading to v0.4)
Update Calico from v3.7.3 to v3.7.4 * https://docs.projectcalico.org/v3.7/release-notes/
2019-07-03 05:18:02 +02:00
Improve apiserver backend service zone spanning * google_compute_backend_services use nested blocks to define backends (instance groups heterogeneous controllers) * Use Terraform v0.12.x dynamic blocks so the apiserver backend service can refer to (up to zone-many) controller instance groups * Previously, with Terraform v0.11.x, the apiserver backend service had to list a fixed set of backends to span controller nodes across zones in multi-controller setups. 3 backends were used because each GCP region offered at least 3 zones. Single-controller clusters had the cosmetic ugliness of unused instance groups * Allow controllers to span more than 3 zones if avilable in a region (e.g. currently only us-central1, with 4 zones) Related: * https://www.terraform.io/docs/providers/google/r/compute_backend_service.html * https://www.terraform.io/docs/configuration/expressions.html#dynamic-blocks
2019-07-06 04:21:05 +02:00
#### Google Cloud
* Allow controller nodes to span more than 3 zones if available in a region ([#504](https://github.com/poseidon/typhoon/pull/504))
* Eliminate extraneous controller instance groups in single-controller clusters ([#504](https://github.com/poseidon/typhoon/pull/504))
Raise GCP network deletion timeout from 4m to 6m * Fix a GCP errata item https://github.com/poseidon/typhoon/wiki/Errata * Removal of a Google Cloud cluster often required 2 runs of `terraform apply` because network resource deletes timeout after 4m. Raise the network deletion timeout to 6m to ensure apply only needs to be run once to remove a cluster
2019-07-06 04:48:49 +02:00
* Raise network deletion timeout from 4m to 6m ([#505](https://github.com/poseidon/typhoon/pull/505))
Improve apiserver backend service zone spanning * google_compute_backend_services use nested blocks to define backends (instance groups heterogeneous controllers) * Use Terraform v0.12.x dynamic blocks so the apiserver backend service can refer to (up to zone-many) controller instance groups * Previously, with Terraform v0.11.x, the apiserver backend service had to list a fixed set of backends to span controller nodes across zones in multi-controller setups. 3 backends were used because each GCP region offered at least 3 zones. Single-controller clusters had the cosmetic ugliness of unused instance groups * Allow controllers to span more than 3 zones if avilable in a region (e.g. currently only us-central1, with 4 zones) Related: * https://www.terraform.io/docs/providers/google/r/compute_backend_service.html * https://www.terraform.io/docs/configuration/expressions.html#dynamic-blocks
2019-07-06 04:21:05 +02:00
Update Grafana from v6.2.4 to v6.2.5 * https://github.com/grafana/grafana/releases/tag/v6.2.5
2019-06-29 22:17:27 +02:00
#### Addons
Update Prometheus from v2.11.0-rc.0 to v2.11.0 * https://github.com/prometheus/prometheus/releases/tag/v2.11.0
2019-07-10 05:54:57 +02:00
* Update Prometheus from v2.10.0 to v2.11.0
Update kube-state-metrics from v1.6.0 to v1.7.0-rc.1 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.0-rc.1 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.0-rc.0
2019-07-13 22:13:57 +02:00
* Update kube-state-metrics from v1.6.0 to v1.7.0-rc.1
Update Grafana from v6.2.4 to v6.2.5 * https://github.com/grafana/grafana/releases/tag/v6.2.5
2019-06-29 22:17:27 +02:00
* Update Grafana from v6.2.4 to v6.2.5
Upgrade nginx-ingress from v0.24.1 to v0.25.0 * Support networking.k8s.io/v1beta1 apiVersion * Update RBAC cluster-role for networking.k8s.io/v1beta1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.25.0
2019-07-09 07:04:50 +02:00
* Update nginx-ingress from v0.24.1 to v0.25.0
* Support `networking.k8s.io/v1beta1` apiVersion
Update Grafana from v6.2.4 to v6.2.5 * https://github.com/grafana/grafana/releases/tag/v6.2.5
2019-06-29 22:17:27 +02:00
Update Kubernetes from v1.14.3 to v1.15.0 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#v1150 * Remove docs referring to possible v1.14.4 release
2019-06-20 06:29:43 +02:00
## v1.15.0
* Kubernetes [v1.15.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#v1150)
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
* Migrate from Terraform v0.11 to v0.12.x (**action required!**)
Add migration instructions from Terraform v0.11 to v0.12 * Provide Terraform v0.11 to v0.12 migration guide. Show an in-place strategy and a move resources strategy * Describe in-place modifying an existing cluster and providers, using the Terraform helper to edit syntax, and checking the plan produces a zero diff * Describe replacing existing clusters by creating a new config directory for use with Terraform v0.12 only and moving resources one by one * Provide some limited advise on migrating non-Typhoon resources
2019-05-31 09:27:25 +02:00
* [Migration](https://typhoon.psdn.io/topics/maintenance/#terraform-v012x) instructions for Terraform v0.12
* Require `terraform-provider-ct` v0.3.2+ to support Terraform v0.12 (action required)
Update Calico from v3.7.2 to v3.7.3 * https://docs.projectcalico.org/v3.7/release-notes/
2019-06-14 08:54:20 +02:00
* Update Calico from v3.7.2 to [v3.7.3](https://docs.projectcalico.org/v3.7/release-notes/)
Remove Fedora Atomic modules * Typhoon for Fedora Atomic was deprecated in March 2019 * https://typhoon.psdn.io/announce/#march-27-2019
2019-06-23 22:38:49 +02:00
* Remove Fedora Atomic modules (deprecated in March) ([#501](https://github.com/poseidon/typhoon/pull/501))
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
#### AWS
* Require `terraform-provider-aws` v2.7+ to support Terraform v0.12 (action required)
Allow using Flatcar Linux Edge on bare-metal and AWS * On AWS, use Flatcar Linux Edge by setting `os_image` to "flatcar-edge" * On bare-metal, Flatcar Linux Edge by setting `os_channel` to "flatcar-edge"
2019-06-12 07:13:41 +02:00
* Allow using Flatcar Linux Edge by setting `os_image` to "flatcar-edge"
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
#### Azure
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
* Require `terraform-provider-azurerm` v1.27+ to support Terraform v0.12 (action required)
Avoid unneeded rotations of Regular priority virtual machine scale sets * Azure only allows `eviction_policy` to be set for Low priority VMs. Supporting Low priority VMs meant when Regular VMs were used, each `terraform apply` rolled workers, to set eviction_policy to null. * Terraform v0.12 nullable variables fix the issue and plan does not produce a diff
2019-05-28 07:55:16 +02:00
* Avoid unneeded rotations of Regular priority virtual machine scale sets
* Azure only allows `eviction_policy` to be set for Low priority VMs. Supporting Low priority VMs meant when Regular VMs were used, each `terraform apply` rolled workers, to set eviction_policy to null.
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
* Terraform v0.12 nullable variables fix the issue so plan does not produce a diff.
#### Bare-Metal
* Require `terraform-provider-matchbox` v0.3.0+ to support Terraform v0.12 (action required)
Allow using Flatcar Linux Edge on bare-metal and AWS * On AWS, use Flatcar Linux Edge by setting `os_image` to "flatcar-edge" * On bare-metal, Flatcar Linux Edge by setting `os_channel` to "flatcar-edge"
2019-06-12 07:13:41 +02:00
* Allow using Flatcar Linux Edge by setting `os_channel` to "flatcar-edge"
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
Migrate DigitalOcean module from Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update DigitalOcean tutorial documentation * Define Terraform and plugin version requirements in versions.tf * Require digitalocean ~> v1.3 to support Terraform v0.12 * Require ct ~> v0.3.2 to support Terraform v0.12
2019-05-28 00:37:36 +02:00
#### DigitalOcean
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
* Require `terraform-provider-digitalocean` v1.3+ to support Terraform v0.12 (action required)
Change DO worker_type default from s-1vcpu-1gb to s-1vcpu-2gb * On DigitalOcean, `s-1vcpu-1gb` worker nodes have 1GB of RAM, which is too small as a default, even for most cost constrained developers
2019-06-01 22:49:56 +02:00
* Change the default `worker_type` from `s-1vcpu1-1gb` to `s-1vcpu-2gb`
Migrate DigitalOcean module from Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update DigitalOcean tutorial documentation * Define Terraform and plugin version requirements in versions.tf * Require digitalocean ~> v1.3 to support Terraform v0.12 * Require ct ~> v0.3.2 to support Terraform v0.12
2019-05-28 00:37:36 +02:00
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
#### Google Cloud
Migrate bare-metal module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update bare-metal tutorial * Define `clc_snippets` type constraint map(list(string)) * Define Terraform and plugin version requirements in versions.tf * Require matchbox ~> 0.3.0 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-29 04:19:23 +02:00
* Require `terraform-provider-google` v2.5+ to support Terraform v0.12 (action required)
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
Update Grafana from v6.2.1 to v6.2.2 * https://github.com/grafana/grafana/releases/tag/v6.2.2
2019-06-07 09:07:54 +02:00
#### Addons
Update Grafana from v6.2.2 to v6.2.4 * https://github.com/grafana/grafana/releases/tag/v6.2.4
2019-06-20 06:51:54 +02:00
* Update Grafana from v6.2.1 to v6.2.4
Update node-exporter from v0.18.0 to v0.18.1 * https://github.com/prometheus/node_exporter/releases/tag/v0.18.1
2019-06-07 11:08:28 +02:00
* Update node-exporter from v0.18.0 to v0.18.1
Update Grafana from v6.2.1 to v6.2.2 * https://github.com/grafana/grafana/releases/tag/v6.2.2
2019-06-07 09:07:54 +02:00
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
## v1.14.3
Bump Terraform provider versions in docs * Bump Terraform provider versions to reflect the versions used by the maintainer
2019-05-20 18:29:56 +02:00
Update Kubernetes from v1.14.2 to v1.14.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1143
2019-05-31 10:08:32 +02:00
* Kubernetes [v1.14.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1143)
Update CoreDNS from v1.3.1 to v1.5.0 * Add `ready` plugin to improve readinessProbe * https://coredns.io/2019/04/06/coredns-1.5.0-release/
2019-05-27 09:11:52 +02:00
* Update CoreDNS from v1.3.1 to v1.5.0
* Add `ready` plugin to improve readinessProbe
Fix terraform-render-bootkube to remove trailing slash * Fix to remove a trailing slash that was erroneously introduced in the scripting that updated from v1.14.1 to v1.14.2 * Workaround before this fix was to re-run `terraform init`
2019-05-22 18:24:42 +02:00
* Fix trailing slash in terraform-render-bootkube version ([#479](https://github.com/poseidon/typhoon/pull/479))
Recommend updating Terraform providers ct and matchbox * Recomment updating Terraform provider plugins `terraform-provider-ct` and `terraform-provider-matchbox` to prepare for the upcoming Terraform v0.12 migration * https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.3.2 * https://github.com/poseidon/terraform-provider-matchbox/releases/tag/v0.3.0
2019-05-31 09:45:16 +02:00
* Recommend updating `terraform-provider-ct` plugin from v0.3.1 to [v0.3.2](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.3.2) ([#487](https://github.com/poseidon/typhoon/pull/487))
Fix terraform-render-bootkube to remove trailing slash * Fix to remove a trailing slash that was erroneously introduced in the scripting that updated from v1.14.1 to v1.14.2 * Workaround before this fix was to re-run `terraform init`
2019-05-22 18:24:42 +02:00
Migrate Azure module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Azure tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require azurerm ~> 1.27 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:43:08 +02:00
#### AWS
Rename worker pool modules' count variable to worker_count * This change affects users who use worker pools on AWS, GCP, or Azure with a Container Linux derivative * Rename worker pool modules' `count` variable to `worker_count`, because `count` will be a reserved variable name in Terraform v0.12
2019-05-28 01:33:21 +02:00
* Rename `worker` pool module `count` variable to `worker_count` ([#485](https://github.com/poseidon/typhoon/pull/485)) (action required)
* `count` will become a reserved variable name in Terraform v0.12
Replace deprecated `azurerm_autoscale_setting` * Fix Terraform provider azure warning about `azurerm_autoscale_setting` * Require terraform-provider-azure v1.22+ version that introduces the new `azurerm_monitor_autoscale_setting` resource * https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/CHANGELOG.md#1220-february-11-2019
2019-05-27 08:14:50 +02:00
#### Azure
* Replace `azurerm_autoscale_setting` with `azurerm_monitor_autoscale_setting` ([#482](https://github.com/poseidon/typhoon/pull/482))
Rename worker pool modules' count variable to worker_count * This change affects users who use worker pools on AWS, GCP, or Azure with a Container Linux derivative * Rename worker pool modules' `count` variable to `worker_count`, because `count` will be a reserved variable name in Terraform v0.12
2019-05-28 01:33:21 +02:00
* Rename `worker` pool module `count` variable to `worker_count` ([#485](https://github.com/poseidon/typhoon/pull/485)) (action required)
* `count` will become a reserved variable name in Terraform v0.12
Recommend updating Terraform providers ct and matchbox * Recomment updating Terraform provider plugins `terraform-provider-ct` and `terraform-provider-matchbox` to prepare for the upcoming Terraform v0.12 migration * https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.3.2 * https://github.com/poseidon/terraform-provider-matchbox/releases/tag/v0.3.0
2019-05-31 09:45:16 +02:00
#### Bare-Metal
* Recommend updating `terraform-provider-matchbox` plugin from v0.2.3 to [v0.3.0](https://github.com/poseidon/terraform-provider-matchbox/releases/tag/v0.3.0) ([#487](https://github.com/poseidon/typhoon/pull/487))
#### Google Cloud
Rename worker pool modules' count variable to worker_count * This change affects users who use worker pools on AWS, GCP, or Azure with a Container Linux derivative * Rename worker pool modules' `count` variable to `worker_count`, because `count` will be a reserved variable name in Terraform v0.12
2019-05-28 01:33:21 +02:00
* Rename `worker` pool module `count` variable to `worker_count` ([#485](https://github.com/poseidon/typhoon/pull/485)) (action required)
Migrate Google Cloud module Terraform v0.11 to v0.12 * Replace v0.11 bracket type hints with Terraform v0.12 list expressions * Use expression syntax instead of interpolated strings, where suggested * Update Google Cloud tutorial and worker pools documentation * Define Terraform and plugin version requirements in versions.tf * Require google ~> 2.5 to support Terraform v0.12 * Require ct ~> 0.3.2 to support Terraform v0.12
2019-05-28 06:14:25 +02:00
* `count` is a reserved variable in Terraform v0.12
Replace deprecated `azurerm_autoscale_setting` * Fix Terraform provider azure warning about `azurerm_autoscale_setting` * Require terraform-provider-azure v1.22+ version that introduces the new `azurerm_monitor_autoscale_setting` resource * https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/CHANGELOG.md#1220-february-11-2019
2019-05-27 08:14:50 +02:00
Update Prometheus from v2.9.2 to v2.10.0 * https://github.com/prometheus/prometheus/releases/tag/v2.10.0
2019-05-27 06:58:28 +02:00
#### Addons
* Update Prometheus from v2.9.2 to v2.10.0
Update Grafana from v2.6.0 to v2.6.1
2019-05-27 21:25:00 +02:00
* Update Grafana from v6.1.6 to v6.2.1
Update Prometheus from v2.9.2 to v2.10.0 * https://github.com/prometheus/prometheus/releases/tag/v2.10.0
2019-05-27 06:58:28 +02:00
Bump Terraform provider versions in docs * Bump Terraform provider versions to reflect the versions used by the maintainer
2019-05-20 18:29:56 +02:00
## v1.14.2
Update etcd from v3.3.12 to v3.3.13 on Container Linux * Skip updating etcd for Fedora Atomic clusters, now that Fedora Atomic has been deprecated
2019-05-04 20:42:51 +02:00
Update Kubernetes from v1.14.1 to v1.14.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1142
2019-05-17 13:09:15 +02:00
* Kubernetes [v1.14.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1142)
Update etcd from v3.3.12 to v3.3.13 on Container Linux * Skip updating etcd for Fedora Atomic clusters, now that Fedora Atomic has been deprecated
2019-05-04 20:42:51 +02:00
* Update etcd from v3.3.12 to [v3.3.13](https://github.com/etcd-io/etcd/releases/tag/v3.3.13)
Update Calico from v3.7.0 to v3.7.2 * https://docs.projectcalico.org/v3.7/release-notes/
2019-05-17 12:29:46 +02:00
* Upgrade Calico from v3.6.1 to [v3.7.2](https://docs.projectcalico.org/v3.7/release-notes/)
Allow Calico networking on Azure and DigitalOcean * Introduce "calico" as a `networking` option on Azure and DigitalOcean using Calico's new VXLAN support (similar to flannel). Flannel remains the default on these platforms for now. * Historically, DigitalOcean and Azure only allowed Flannel as the CNI provider, since those platforms don't support IPIP traffic that was previously required for Calico. * Looking forward, its desireable for Calico to become the default across Typhoon clusters, since it provides NetworkPolicy and a consistent experience * No changes to AWS, GCP, or bare-metal where Calico remains the default CNI provider. On these platforms, IPIP mode will always be used, since its available and more performant than vxlan
2019-05-06 09:38:23 +02:00
* Change flannel VXLAN port from 8472 (kernel default) to 4789 (IANA VXLAN)
Change flannel port from 8472 to 4789 * Change flannel port from the kernel default 8472 to the IANA assigned VXLAN port 4789 * Update firewall rules or security groups for VXLAN * Why now? Calico now offers its own VXLAN backend so standardizing on the IANA port will simplify config * https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan
2019-05-07 06:56:38 +02:00
#### AWS
Allow Calico networking on Azure and DigitalOcean * Introduce "calico" as a `networking` option on Azure and DigitalOcean using Calico's new VXLAN support (similar to flannel). Flannel remains the default on these platforms for now. * Historically, DigitalOcean and Azure only allowed Flannel as the CNI provider, since those platforms don't support IPIP traffic that was previously required for Calico. * Looking forward, its desireable for Calico to become the default across Typhoon clusters, since it provides NetworkPolicy and a consistent experience * No changes to AWS, GCP, or bare-metal where Calico remains the default CNI provider. On these platforms, IPIP mode will always be used, since its available and more performant than vxlan
2019-05-06 09:38:23 +02:00
* Only set internal VXLAN rules when `networking` is "flannel" (default: calico)
#### Azure
* Allow choosing Calico as the network provider (experimental) ([#472](https://github.com/poseidon/typhoon/pull/472))
* Add a `networking` variable accepting "flannel" (default) or "calico"
* Use VXLAN encapsulation since Azure doesn't support IPIP
Remove unofficial bare-metal *_networkds variables * Remove controller_networkds and worker_networkds variables. These variables were always listed as experimental, unsupported, and excluded from documentation in anticipation of Container Linux Config snippets * Use Container Linux Config snippets on bare-metal instead. They provide safer, more powerful, and more elegant host customization
2018-08-13 01:44:13 +02:00
Fix race condition in DigitalOcean cluster create * DigitalOcean clusters must secure copy a kubeconfig to worker nodes, but Terraform could decide to try copying before firewall rules have been added to allow SSH access. * Add an explicit dependency on adding firewall rules first
2019-05-17 12:52:16 +02:00
#### DigitalOcean
Allow Calico networking on Azure and DigitalOcean * Introduce "calico" as a `networking` option on Azure and DigitalOcean using Calico's new VXLAN support (similar to flannel). Flannel remains the default on these platforms for now. * Historically, DigitalOcean and Azure only allowed Flannel as the CNI provider, since those platforms don't support IPIP traffic that was previously required for Calico. * Looking forward, its desireable for Calico to become the default across Typhoon clusters, since it provides NetworkPolicy and a consistent experience * No changes to AWS, GCP, or bare-metal where Calico remains the default CNI provider. On these platforms, IPIP mode will always be used, since its available and more performant than vxlan
2019-05-06 09:38:23 +02:00
* Allow choosing Calico as the network provider (experimental) ([#472](https://github.com/poseidon/typhoon/pull/472))
* Add a `networking` variable accepting "flannel" (default) or "calico"
* Use VXLAN encapsulation since DigitalOcean doesn't support IPIP
Fix race condition in DigitalOcean cluster create * DigitalOcean clusters must secure copy a kubeconfig to worker nodes, but Terraform could decide to try copying before firewall rules have been added to allow SSH access. * Add an explicit dependency on adding firewall rules first
2019-05-17 12:52:16 +02:00
* Add explicit ordering between firewall rule creation and secure copying Kubelet credentials ([#469](https://github.com/poseidon/typhoon/pull/469))
* Fix race scenario if copies to nodes were before rule creation, blocking cluster creation
Update Prometheus from v2.8.1 to v2.9.1 * https://github.com/prometheus/prometheus/releases/tag/v2.9.1 * https://github.com/prometheus/prometheus/releases/tag/v2.9.0
2019-04-19 08:26:32 +02:00
#### Addons
Update Prometheus from v2.9.1 to v2.9.2 * https://github.com/prometheus/prometheus/releases/tag/v2.9.2
2019-04-28 05:39:55 +02:00
* Update Prometheus from v2.8.1 to v2.9.2
Update kube-state-metrics from v1.6.0-rc.2 to v1.6.0 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.6.0
2019-05-07 06:30:49 +02:00
* Update kube-state-metrics from v1.5.0 to v1.6.0
Update node_exporter from v0.17.0 to v0.18.0 * https://github.com/prometheus/node_exporter/releases/tag/v0.18.0
2019-05-17 20:01:30 +02:00
* Update node-exporter from v0.17.0 to v0.18.0
Update Grafana from v6.1.4 to v6.1.6 * https://github.com/grafana/grafana/releases/tag/v6.1.6
2019-05-04 20:14:37 +02:00
* Update Grafana from v6.1.3 to v6.1.6
Update etcd from v3.3.12 to v3.3.13 on Container Linux * Skip updating etcd for Fedora Atomic clusters, now that Fedora Atomic has been deprecated
2019-05-04 20:42:51 +02:00
* Reduce nginx-ingress Role RBAC permissions ([#458](https://github.com/poseidon/typhoon/pull/458))
Update Prometheus from v2.8.1 to v2.9.1 * https://github.com/prometheus/prometheus/releases/tag/v2.9.1 * https://github.com/prometheus/prometheus/releases/tag/v2.9.0
2019-04-19 08:26:32 +02:00
Update provider versions in tutorial docs * Update terraform provider plugin version in docs to reflect the recommended current versions that are currently used
2019-04-16 09:05:13 +02:00
## v1.14.1
Update Kubernetes from v1.14.0 to v1.14.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#changelog-since-v1140
2019-04-10 06:47:23 +02:00
* Kubernetes [v1.14.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1141)
Update Grafana from v6.1.1 to v6.1.3 * https://github.com/grafana/grafana/releases/tag/v6.1.3
2019-04-10 07:06:27 +02:00
#### Addons
* Update Grafana from v6.1.1 to v6.1.3
Update nginx-ingress from v0.23.0 to v0.24.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.24.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.24.0
2019-04-16 06:07:12 +02:00
* Update nginx-ingress from v0.23.0 to v0.24.1
Revert "Update kube-state-metrics from v1.5.0 to v1.6.0-rc.0" * This reverts commit 6e5d66cf666a2700ad3e540698a6e243651b96d9 * kube-state-metrics v1.6.0-rc.0 fires KubeDeploymentReplicasMismatch alerts where its own Deployment doesn't have replicas available, (kube_deployment_status_replicas_available) even though all replicas are available according to kubectl inspection * This problem was present even with the CSR ClusterRole fix (https://github.com/kubernetes/kube-state-metrics/pull/717)
2019-04-13 21:37:53 +02:00
Update CHANGES for v1.14.0 release
2019-04-09 03:48:49 +02:00
## v1.14.0
Update Kubernetes from v1.13.5 to v1.14.0 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1140
2019-04-07 09:09:00 +02:00
* Kubernetes [v1.14.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1140)
Update Calico from v3.6.0 to v3.6.1 * https://docs.projectcalico.org/v3.6/release-notes/
2019-04-01 02:43:43 +02:00
* Update Calico from v3.6.0 to v3.6.1
Add ability to load balance TCP/UDP applications on Azure * Add ability to load balance TCP/UDP applications (e.g. NodePort) * Output the load balancer ID as `loadbalancer_id` * Output `worker_security_group_name` and `worker_address_prefix` for extending firewall rules
2019-04-08 03:04:02 +02:00
* Add `enable_aggregation` option for CNCF conformance ([#436](https://github.com/poseidon/typhoon/pull/436))
Add enable_aggregation option (defaults to false) * Add an `enable_aggregation` variable to enable the kube-apiserver aggregation layer for adding extension apiservers to clusters * Aggregation is **disabled** by default. Typhoon recommends you not enable aggregation. Consider whether less invasive ways to achieve your goals are possible and whether those goals are well-founded * Enabling aggregation and extension apiservers increases the attack surface of a cluster and makes extensions a part of the control plane. Admins must scrutinize and trust any extension apiserver used. * Passing a v1.14 CNCF conformance test requires aggregation be enabled. Having an option for aggregation keeps compliance, but retains the stricter security posture on default clusters
2019-04-07 11:29:07 +02:00
* Aggregation is disabled by default to retain our security stance
* Aggregation increases the security surface area. Extensions become part of the control plane and must be scrutinized carefully and trusted. Favor leaving aggregation disabled.
Update Calico from v3.6.0 to v3.6.1 * https://docs.projectcalico.org/v3.6/release-notes/
2019-04-01 02:43:43 +02:00
Add ability to load balance TCP applications on AWS * Add ability to load balance TCP applications (e.g. NodePort) * Output the network load balancer ARN as `nlb_id` * Accept a `worker_target_groups` (ARN) list to which worker instances should be added * AWS NLBs and target groups don't support UDP
2019-04-01 08:22:47 +02:00
#### AWS
* Add ability to load balance TCP applications ([#443](https://github.com/poseidon/typhoon/pull/443))
* Output the network load balancer ARN as `nlb_id`
* Accept a `worker_target_groups` (ARN) list to which worker instances should be added
Add ability to load balance TCP/UDP applications on Azure * Add ability to load balance TCP/UDP applications (e.g. NodePort) * Output the load balancer ID as `loadbalancer_id` * Output `worker_security_group_name` and `worker_address_prefix` for extending firewall rules
2019-04-08 03:04:02 +02:00
#### Azure
* Add ability to load balance TCP/UDP applications ([#447](https://github.com/poseidon/typhoon/pull/447))
* Output the load balancer ID as `loadbalancer_id`
* Output `worker_security_group_name` and `worker_address_prefix` for extending firewall rules ([#447](https://github.com/poseidon/typhoon/pull/447))
Harden internal firewall rules on DigitalOcean * Define firewall rules on DigitialOcean to match rules used on AWS, GCP, and Azure * Output `controller_tag` and `worker_tag` to simplify custom firewall rule creation
2019-04-03 08:02:04 +02:00
#### DigitalOcean
Add ability to load balance TCP/UDP applications on Azure * Add ability to load balance TCP/UDP applications (e.g. NodePort) * Output the load balancer ID as `loadbalancer_id` * Output `worker_security_group_name` and `worker_address_prefix` for extending firewall rules
2019-04-08 03:04:02 +02:00
* Harden internal (node-to-node) firewall rules to align with other platforms ([#444](https://github.com/poseidon/typhoon/pull/444))
Update CHANGES for v1.14.0 release
2019-04-09 03:48:49 +02:00
* Add ability to load balance TCP applications ([#444](https://github.com/poseidon/typhoon/pull/444))
* Output `controller_tag` and `worker_tag` for extending firewall rules ([#444](https://github.com/poseidon/typhoon/pull/444))
Harden internal firewall rules on DigitalOcean * Define firewall rules on DigitialOcean to match rules used on AWS, GCP, and Azure * Output `controller_tag` and `worker_tag` to simplify custom firewall rule creation
2019-04-03 08:02:04 +02:00
Remove Haswell minimum CPU platform requirement * Google Cloud API implements `min_cpu_platform` to mean "use exactly this CPU" * Fix error creating clusters in newer regions lacking Haswell platform (e.g. europe-west2) (#438) * Reverts #405, added in v1.13.4 * Original goal of ignoring old Ivy/Sandy bridge CPUs in older regions will be achieved shortly anyway. Google Cloud is deprecating those CPUs in April 2019 * https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform#how_selecting_a_minimum_cpu_platform_works
2019-03-28 03:45:10 +01:00
#### Google Cloud
Add Google Cloud worker instances to a target pool * Background: A managed instance group of workers is used in backend services for global load balancing (HTTP/HTTPS Ingress) and output for custom global load balancing use cases * Add worker instances to a target pool load balancing TCP/UDP applications (NodePort or proxied). Output as `worker_target_pool` * Health check for workers with a healthy Ingress controller. Forward rules (regional) to target pools don't support different external and internal ports so choosing nodes with Ingress allows proxying as a workaround * A target pool is a logical grouping only. It doesn't add costs to clusters or worker pools
2019-03-30 23:12:55 +01:00
* Add ability to load balance TCP/UDP applications ([#442](https://github.com/poseidon/typhoon/pull/442))
* Add worker instances to a target pool, output as `worker_target_pool`
* Health check for workers with Ingress controllers. Forward rules don't support differing internal/external ports, but some Ingress controllers support TCP/UDP proxy as a workaround
Remove Haswell minimum CPU platform requirement * Google Cloud API implements `min_cpu_platform` to mean "use exactly this CPU" * Fix error creating clusters in newer regions lacking Haswell platform (e.g. europe-west2) (#438) * Reverts #405, added in v1.13.4 * Original goal of ignoring old Ivy/Sandy bridge CPUs in older regions will be achieved shortly anyway. Google Cloud is deprecating those CPUs in April 2019 * https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform#how_selecting_a_minimum_cpu_platform_works
2019-03-28 03:45:10 +01:00
* Remove Haswell minimum CPU platform requirement ([#439](https://github.com/poseidon/typhoon/pull/439))
* Google Cloud API implements `min_cpu_platform` to mean "use exactly this CPU". Revert [#405](https://github.com/poseidon/typhoon/pull/405) added in v1.13.4.
* Fix error creating clusters in new regions without Haswell (e.g. europe-west2) ([#438](https://github.com/poseidon/typhoon/issues/438))
Update Prometheus from v2.8.0 to v2.8.1 * https://github.com/prometheus/prometheus/releases/tag/v2.8.1
2019-04-01 02:03:22 +02:00
#### Addons
* Update Prometheus from v2.8.0 to v2.8.1
Update Grafana from v6.1.0 to v6.1.1
2019-04-07 03:31:43 +02:00
* Update Grafana from v6.0.2 to [v6.1.1](http://docs.grafana.org/guides/whats-new-in-v6-1/)
Refresh Prometheus rules and Grafana dashboards * Refresh rules and dashboards from upstreams * Add new Kubernetes "workload" dashboards * View pods in a workload (deployment/daemonset/statefulset) * View workloads in a namespace
2019-04-07 08:27:11 +02:00
* Add dashboard for pods in a workload (deployment/daemonset/statefulset) ([#446](https://github.com/poseidon/typhoon/pull/446))
* Add dashboard for workloads by namespace
Update Prometheus from v2.8.0 to v2.8.1 * https://github.com/prometheus/prometheus/releases/tag/v2.8.1
2019-04-01 02:03:22 +02:00
Update Kubernetes from v1.13.4 to v1.13.5 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1135
2019-03-26 05:43:47 +01:00
## v1.13.5
* Kubernetes [v1.13.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1135)
Resolve in-addr.arpa and ip6.arpa zones with CoreDNS kubernetes plugin * Resolve in-addr.arpa and ip6.arpa DNS PTR requests for Kubernetes service IPs and pod IPs * Previously, CoreDNS was configured to resolve in-addr.arpa PTR records for service IPs (but not pod IPs)
2019-03-05 08:00:13 +01:00
* Resolve in-addr.arpa reverse DNS lookups (PTR) for pod IPv4 addresses ([#415](https://github.com/poseidon/typhoon/pull/415))
* Reverse DNS lookups for service IPv4 addresses unchanged
Update Calico from v3.5.2 to v3.6.0 * Add calico-ipam CRDs and RBAC permissions * Switch IPAM from host-local to calico-ipam * `calico-ipam` subnets `ippools` (defaults to pod CIDR) into `ipamblocks` (defaults to /26, but set to /24 in Typhoon) * `host-local` subnets the pod CIDR based on the node PodCIDR field (set via kube-controller-manager as /24's) * Create a custom default IPv4 IPPool to ensure the block size is kept at /24 to allow 110 pods per node (Kubernetes default) * Retaining host-local was slightly preferred, but Calico v3.6 is migrating all usage to calico-ipam. The codepath that skipped calico-ipam for KDD was removed * https://docs.projectcalico.org/v3.6/release-notes/
2019-03-19 05:07:07 +01:00
* Upgrade Calico from v3.5.2 to [v3.6.0](https://docs.projectcalico.org/v3.6/release-notes/) ([#430](https://github.com/poseidon/typhoon/pull/430))
* Change pod IPAM from `host-local` to `calico-ipam`. `pod_cidr` is still divided into `/24` subnets per node, but managed as `ippools` and `ipamblocks`
Recommend updating Terraform providers ct and matchbox * Recomment updating Terraform provider plugins `terraform-provider-ct` and `terraform-provider-matchbox` to prepare for the upcoming Terraform v0.12 migration * https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.3.2 * https://github.com/poseidon/terraform-provider-matchbox/releases/tag/v0.3.0
2019-05-31 09:45:16 +02:00
* Recommend updating [terraform-provider-ct](https://github.com/poseidon/terraform-provider-ct) from v0.3.0 to [v0.3.1](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.3.1) ([#434](https://github.com/poseidon/typhoon/pull/434))
Announce Fedora Atomic modules won't be updated beyond v1.13.x * Thank you Project Atomic team and users * See the deprecation announcement https://typhoon.psdn.io/announce/#march-27-2019
2019-03-27 07:47:14 +01:00
* Announce: Fedora Atomic modules will be not be updated beyond Kubernetes v1.13.x ([#437](https://github.com/poseidon/typhoon/pull/437))
* Thank you Project Atomic team and users, please see the deprecation [notice](https://typhoon.psdn.io/announce/#march-27-2019)
Resolve in-addr.arpa and ip6.arpa zones with CoreDNS kubernetes plugin * Resolve in-addr.arpa and ip6.arpa DNS PTR requests for Kubernetes service IPs and pod IPs * Previously, CoreDNS was configured to resolve in-addr.arpa PTR records for service IPs (but not pod IPs)
2019-03-05 08:00:13 +01:00
Add support for terraform-provider-aws v2.0+ * Allow terraform-provider-aws >= v1.13, but < 3.0. No change to the minimum version, but allow using v2.x.y releases * Verify compatability with terraform-provider-aws v2.1.0
2019-03-09 21:03:10 +01:00
#### AWS
* Support `terraform-provider-aws` v2.0+ ([#419](https://github.com/poseidon/typhoon/pull/419))
Change default iPXE kernel/initrd download from HTTP to HTTPS * Require an iPXE-enabled network boot environment with support for TLS downloads. PXE clients must chainload to iPXE firmware compiled with `DOWNLOAD_PROTO_HTTPS` enabled ([crypto](https://ipxe.org/crypto)) * iPXE's pre-compiled firmware binaries do _not_ enable HTTPS. Admins should build iPXE from source with support enabled * Affects the Container Linux and Flatcar Linux install profiles that pull from public downloads. No effect when cached_install=true or using Fedora Atomic, as those download from Matchbox * Add `download_protocol` variable. Recognizing boot firmware TLS support is difficult in some environments, set the protocol to "http" for the old behavior (discouraged)
2019-03-10 04:34:15 +01:00
#### Bare-Metal
* Change the default iPXE kernel and initrd download protocol from HTTP to HTTPS ([#420](https://github.com/poseidon/typhoon/pull/420))
* Require an iPXE-enabled network boot environment with support for TLS downloads. PXE clients must chainload to iPXE firmware compiled with `DOWNLOAD_PROTO_HTTPS` [enabled](https://ipxe.org/crypto). (**action required**)
Update mkdocs and plugin versions used in tutorials * Recommend provider plugin versions that are currently used by the author * Recommend updating terraform-provider-ct plugin from v0.3.0 to v0.3.1 * https://github.com/coreos/terraform-provider-ct/releases
2019-03-26 08:46:11 +01:00
* Only affects Container Linux and Flatcar Linux install profiles that pull public images (default)
Change default iPXE kernel/initrd download from HTTP to HTTPS * Require an iPXE-enabled network boot environment with support for TLS downloads. PXE clients must chainload to iPXE firmware compiled with `DOWNLOAD_PROTO_HTTPS` enabled ([crypto](https://ipxe.org/crypto)) * iPXE's pre-compiled firmware binaries do _not_ enable HTTPS. Admins should build iPXE from source with support enabled * Affects the Container Linux and Flatcar Linux install profiles that pull from public downloads. No effect when cached_install=true or using Fedora Atomic, as those download from Matchbox * Add `download_protocol` variable. Recognizing boot firmware TLS support is difficult in some environments, set the protocol to "http" for the old behavior (discouraged)
2019-03-10 04:34:15 +01:00
* Add `download_protocol` variable. Recognizing boot firmware TLS support is difficult in some environments, set the protocol to "http" for the old behavior (discouraged)
Re-add Kubelet metadata service dependency on DigitalOcean * Restore the original special-casing of DigitalOcean Kubelets * Fix node metadata InternalIP being set to the IP of the default gateway on DigitalOcean nodes (regressed in v1.12.3) * Reverts the "pretty" node names on DigitalOcean (worker-2 vs IP) * Closes #424 (full details)
2019-03-14 08:55:55 +01:00
#### DigitalOcean
* Fix kubelet hostname-override to set node metadata InternalIP correctly ([#424](https://github.com/poseidon/typhoon/issues/424))
* Uniquely, DigitalOcean does not resolve hostnames to instance private IPs. Kubelet auto-detect mechanisms require the internal IP be set directly.
* Regressed in v1.12.3 ([#337](https://github.com/poseidon/typhoon/pull/337)) which aimed to provide friendly hostname-based node names on DigitalOcean
Update Prometheus from v2.7.1 to v2.7.2 * https://github.com/prometheus/prometheus/releases/tag/v2.7.2
2019-03-05 08:08:12 +01:00
#### Addons
Update Prometheus from v2.7.2 to v2.8.0 * https://github.com/prometheus/prometheus/releases/tag/v2.8.0
2019-03-14 06:11:38 +01:00
* Update Prometheus from v2.7.1 to [v2.8.0](https://github.com/prometheus/prometheus/releases/tag/v2.8.0)
Refresh Prometheus rules and Grafana dashboards * Refresh rules and dashboards from upstreams * Organize dashboards and stay below the ConfigMap size limit
2019-03-14 07:05:14 +01:00
* Refresh rules based on upstreams ([#426](https://github.com/poseidon/typhoon/pull/426))
Add NetworkPolicy to limit traffic into Prometheus * Allow traffic from Grafana to Prometheus in monitoring * Allow traffic from Prometheus to Prometheus in monitoring * NetworkPolicy denies non-whitelisted traffic. Define policy to allow other access
2019-03-24 01:59:47 +01:00
* Define NetworkPolicy to allow only traffic from the Grafana addon
Update Grafana from v6.0.1 to v6.0.2 * https://github.com/grafana/grafana/releases/tag/v6.0.2
2019-03-22 07:41:25 +01:00
* Update Grafana from v6.0.0 to v6.0.2
Add liveness and readiness probes to Grafana * https://github.com/grafana/grafana/issues/3302
2019-03-24 01:54:16 +01:00
* Add liveness and readiness probes
Refresh Prometheus rules and Grafana dashboards * Refresh rules and dashboards from upstreams * Organize dashboards and stay below the ConfigMap size limit
2019-03-14 07:05:14 +01:00
* Refresh dashboards and organize to stay below ConfigMap size limit ([#426](https://github.com/poseidon/typhoon/pull/426))
Remove heapster manifests from addons * Heapster addon powers `kubectl top` * In early Kubernetes, people legitimately used and expected `kubectl top` to work, so the optional addon was provided * Today the standards are different. Many better monitoring tools exist, that are also less coupled to Kubernetes "kubectl top" reliance on a non-core extensions means its not in-scope for minimal Kubernetes clusters. No more exceptionalism * Finally, Heapster isn't that useful anymore. Its manifests have no need for Typhoon-specific modification * Look to prior releases if you still wish to apply heapster
2019-03-14 07:46:04 +01:00
* Remove heapster manifests from addons ([#427](https://github.com/poseidon/typhoon/pull/427))
* Heapster addon powers `kubectl top` (in early Kubernetes, running the addon was expected). Today, there are better monitoring options.
* `kubectl top` reliance on a non-core extension means its not in-scope for minimal Kubernetes
* Look to prior releases if you still wish to apply heapster
Update Prometheus from v2.7.1 to v2.7.2 * https://github.com/prometheus/prometheus/releases/tag/v2.7.2
2019-03-05 08:08:12 +01:00
Update Kubernetes from v1.13.3 to v1.13.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134
2019-03-01 07:42:04 +01:00
## v1.13.4
* Kubernetes [v1.13.4](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134)
Update etcd from v3.3.11 to v3.3.12 * https://github.com/etcd-io/etcd/releases/tag/v3.3.12
2019-02-09 20:54:54 +01:00
* Update etcd from v3.3.11 to [v3.3.12](https://github.com/etcd-io/etcd/releases/tag/v3.3.12)
Update Calico from v3.5.1 to v3.5.2 * https://docs.projectcalico.org/v3.5/releases/
2019-02-26 06:23:13 +01:00
* Update Calico from v3.5.0 to [v3.5.2](https://docs.projectcalico.org/v3.5/releases/)
Upgrade to support terraform-provider-google v2.0+ * Support terraform-provider-google v1.19.0, v1.19.1, v1.20.0 and v2.0+ (and allow for future 2.x.y releases) * Require terraform-provider-google v1.19.0 or newer. v1.19.0 introduced `network_interface` fields `network_ip` and `nat_ip` to deprecate `address` and `assigned_nat_ip`. Those deprecated fields are removed in terraform-provider-google v2.0 * https://github.com/terraform-providers/terraform-provider-google/releases/tag/v2.0.0
2019-02-20 09:54:19 +01:00
* Assign priorityClassNames to critical cluster and node components ([#406](https://github.com/poseidon/typhoon/pull/406))
Update Kubernetes from v1.13.3 to v1.13.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134
2019-03-01 07:42:04 +01:00
* Inform node out-of-resource eviction and scheduler preemption and ordering
* Add CoreDNS readiness probe ([#410](https://github.com/poseidon/typhoon/pull/410))
Update Calico from v3.5.0 to v3.5.1 * Fix in confd https://github.com/projectcalico/confd/pull/205
2019-02-09 20:49:31 +01:00
Document and recommend terraform-provider-matchbox v0.2.3 * https://github.com/coreos/terraform-provider-matchbox/releases/tag/v0.2.3
2019-02-17 00:01:44 +01:00
#### Bare-Metal
Update links to Matchbox, terraform-provider-ct, etc. * Matchbox, terraform-provider-matchbox, and terraform-provider-ct have moved to the poseidon Github organization
2019-05-04 19:46:07 +02:00
* Recommend updating [terraform-provider-matchbox](https://github.com/poseidon/terraform-provider-matchbox) plugin from v0.2.2 to [v0.2.3](https://github.com/poseidon/terraform-provider-matchbox/releases/tag/v0.2.3) ([#402](https://github.com/poseidon/typhoon/pull/402))
Update Kubernetes from v1.13.3 to v1.13.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134
2019-03-01 07:42:04 +01:00
* Improve docs on using Ubiquiti EdgeOS with bare-metal clusters ([#413](https://github.com/poseidon/typhoon/pull/413))
Document and recommend terraform-provider-matchbox v0.2.3 * https://github.com/coreos/terraform-provider-matchbox/releases/tag/v0.2.3
2019-02-17 00:01:44 +01:00
Set the Google Cloud minimum CPU platform to Intel Haswell * Intel Haswell or better is available in every zone around the world * Neither Kubernetes nor Typhoon have a particular minimum processor family. However, a few Google Cloud zones still default to Sandy/Ivy bridge (scheduled to shift April 2019). Price is only based on machine type so it is beneficial to opt for the next processor family * Intel Haswell is a suitable minimum since it still allows plenty of liberty in choosing any region or machine type * Likely a slight increase to preemption probability in a few zones, but any lower probability on Sandy/Ivy bridge is due to lower desirability as they're phased out * https://cloud.google.com/compute/docs/regions-zones/
2019-02-18 21:54:07 +01:00
#### Google Cloud
Upgrade to support terraform-provider-google v2.0+ * Support terraform-provider-google v1.19.0, v1.19.1, v1.20.0 and v2.0+ (and allow for future 2.x.y releases) * Require terraform-provider-google v1.19.0 or newer. v1.19.0 introduced `network_interface` fields `network_ip` and `nat_ip` to deprecate `address` and `assigned_nat_ip`. Those deprecated fields are removed in terraform-provider-google v2.0 * https://github.com/terraform-providers/terraform-provider-google/releases/tag/v2.0.0
2019-02-20 09:54:19 +01:00
* Support `terraform-provider-google` v2.0+ ([#407](https://github.com/poseidon/typhoon/pull/407))
Update Kubernetes from v1.13.3 to v1.13.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134
2019-03-01 07:42:04 +01:00
* Require `terraform-provider-google` v1.19+ (**action required**)
Set the Google Cloud minimum CPU platform to Intel Haswell * Intel Haswell or better is available in every zone around the world * Neither Kubernetes nor Typhoon have a particular minimum processor family. However, a few Google Cloud zones still default to Sandy/Ivy bridge (scheduled to shift April 2019). Price is only based on machine type so it is beneficial to opt for the next processor family * Intel Haswell is a suitable minimum since it still allows plenty of liberty in choosing any region or machine type * Likely a slight increase to preemption probability in a few zones, but any lower probability on Sandy/Ivy bridge is due to lower desirability as they're phased out * https://cloud.google.com/compute/docs/regions-zones/
2019-02-18 21:54:07 +01:00
* Set the minimum CPU platform to Intel Haswell ([#405](https://github.com/poseidon/typhoon/pull/405))
* Haswell or better is available in every zone (no price change)
* A few zones still default to Sandy/Ivy Bridge (shifts in April 2019)
Raise nginx-ingress liveness/readiness timeout * Under heavy load, avoid timeouts causing nginx-ingress restarts https://github.com/kubernetes/ingress-nginx/pull/3737
2019-02-09 21:23:12 +01:00
#### Addons
Update Kubernetes from v1.13.3 to v1.13.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1134
2019-03-01 07:42:04 +01:00
* Modernize Prometheus rules and alerts ([#404](https://github.com/poseidon/typhoon/pull/404))
Improve Prometheus rules and alerts and Grafana dashboards * Collate upstream rules, alerts, and dashboards and tune for use in Typhoon * Previously, a well-chosen (but older) set of rules, alerts, and dashboards were maintained to reflect metric name changes
2019-02-18 21:05:27 +01:00
* Drop extraneous metrics ([#397](https://github.com/poseidon/typhoon/pull/397))
Add Kubernetes pod name to metrics discovered from service endpoints * Prometheus queries from some upstreams use joins of node-exporter and kube-state-metrics metrics by (namespace,pod). Add the Kubernetes pod name to service endpoint metrics * Rename the kubernetes_namespace field to namespace * Honor labels since kube-state-metrics already include a `pod` field that should not be overridden
2019-02-08 08:26:59 +01:00
* Add `pod` name label to metrics discovered via service endpoints
* Rename `kubernetes_namespace` label to `namespace`
Add links and clarifications in CHANGES for release
2019-03-02 20:26:12 +01:00
* Modernize Grafana and dashboards, see [docs](https://typhoon.psdn.io/addons/grafana/) ([#403](https://github.com/poseidon/typhoon/pull/403), [#404](https://github.com/poseidon/typhoon/pull/404))
Update Grafana from v6.0.0-beta3 to v6.0.0 * https://github.com/grafana/grafana/releases/tag/v6.0.0 * http://docs.grafana.org/guides/whats-new-in-v6-0/
2019-02-26 06:43:43 +01:00
* Upgrade Grafana from v5.4.3 to [v6.0.0](https://github.com/grafana/grafana/releases/tag/v6.0.0)!
Upgrade Grafana to v6.0.0-beta2 and enable Explore UI * Upgrade Grafana from v5.4.3 to v6.0.0-beta2 * Enable Grafana Explore UI while still using only the Viewer role (inspect/edit without saving) * http://docs.grafana.org/guides/whats-new-in-v6-0/
2019-02-17 21:36:40 +01:00
* Enable Grafana [Explore](http://docs.grafana.org/guides/whats-new-in-v6-0/#explore) UI as a Viewer (inspect/edit without saving)
Update nginx-ingress from v0.22.0 to v0.23.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.23.0
2019-03-01 10:18:54 +01:00
* Update nginx-ingress from v0.22.0 to v0.23.0
* Raise nginx-ingress liveness/readiness timeout to 5 seconds
* Remove nginx-ingess default-backend ([#401](https://github.com/poseidon/typhoon/pull/401))
Raise nginx-ingress liveness/readiness timeout * Under heavy load, avoid timeouts causing nginx-ingress restarts https://github.com/kubernetes/ingress-nginx/pull/3737
2019-02-09 21:23:12 +01:00
Add links and clarifications in CHANGES for release
2019-03-02 20:26:12 +01:00
#### Fedora Atomic
* Build Kubelet [system container](https://github.com/poseidon/system-containers) with buildah. The image is an OCI format and slightly larger.
Add CHANGES note about reducing the pod eviciton timeout
2019-02-02 23:54:18 +01:00
## v1.13.3
Update Kubernetes from v1.13.2 to v1.13.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1133
2019-02-02 08:26:13 +01:00
* Kubernetes [v1.13.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1133)
Update etcd from v3.3.10 to v3.3.11 * https://github.com/etcd-io/etcd/releases/tag/v3.3.11
2019-01-12 09:20:47 +01:00
* Update etcd from v3.3.10 to [v3.3.11](https://github.com/etcd-io/etcd/blob/master/CHANGELOG-3.3.md#v3311-2019-1-11)
Update CoreDNS from v1.3.0 to v1.3.1 * https://coredns.io/2019/01/13/coredns-1.3.1-release/
2019-01-16 06:24:35 +01:00
* Update CoreDNS from v1.3.0 to [v1.3.1](https://coredns.io/2019/01/13/coredns-1.3.1-release/)
Switch CoreDNS to use the forward plugin instead of proxy * Use the forward plugin to forward to upstream resolvers, instead of the proxy plugin. The forward plugin is reported to be a faster alternative since it can re-use open sockets * https://coredns.io/explugins/forward/ * https://coredns.io/plugins/proxy/ * https://github.com/kubernetes/kubernetes/issues/73254
2019-01-31 07:25:23 +01:00
* Switch from the `proxy` plugin to the faster `forward` plugin for upsteam resolvers
Update Calico from v3.4.0 to v3.5.0 * https://docs.projectcalico.org/v3.5/releases/
2019-01-28 01:34:30 +01:00
* Update Calico from v3.4.0 to [v3.5.0](https://docs.projectcalico.org/v3.5/releases/)
Update flannel from v0.10.0 to v0.11.0 * https://github.com/coreos/flannel/releases/tag/v0.11.0
2019-01-30 06:51:25 +01:00
* Update flannel from v0.10.0 to [v0.11.0](https://github.com/coreos/flannel/releases/tag/v0.11.0)
Add CHANGES note about reducing the pod eviciton timeout
2019-02-02 23:54:18 +01:00
* Reduce pod eviction timeout for deleting pods on unready nodes to 1 minute
* Respond more quickly to node preemption (previously 5 minutes)
Update nginx-ingress from v0.21.0 to v0.22.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.22.0
2019-01-17 07:59:46 +01:00
* Fix automatic worker deletion on shutdown for cloud platforms
Fix instance shutdown automatic worker deletion on clouds * Fix a regression caused by lowering the Kubelet TLS client certificate to system:nodes group (#100) since dropping cluster-admin dropped the Kubelet's ability to delete nodes. * On clouds where workers can scale down (manual terraform apply, AWS spot termination, Azure low priority deletion), worker shutdown runs the delete-node.service to remove a node to prevent NotReady nodes from accumulating * Allow Kubelets to delete cluster nodes via system:nodes group. Kubelets acting with system:node and kubelet-delete ClusterRoles is still an improvement over acting as cluster-admin
2019-01-15 08:24:41 +01:00
* Lowering Kubelet privileges in [#372](https://github.com/poseidon/typhoon/pull/372) dropped a needed node deletion authorization. Scale-in due to manual terraform apply (any cloud), AWS spot termination, or Azure low priority deletion left old nodes registered, requiring manual deletion (`kubectl delete node name`)
Update etcd from v3.3.10 to v3.3.11 * https://github.com/etcd-io/etcd/releases/tag/v3.3.11
2019-01-12 09:20:47 +01:00
Add AWS ingress_zone_id output with NLB DNS name's Route53 zone id * DNS zones served by AWS Route53 may use AWS's special alias records (other DNS providers would use a CNAME) to resolve the ingress NLB. Alias records require the NLB DNS name's DNS zone id (not the cluster `dns_zone_id`)
2019-01-14 01:37:12 +01:00
#### AWS
* Add `ingress_zone_id` output with the NLB DNS name's Route53 zone for use in alias records ([#380](https://github.com/poseidon/typhoon/pull/380))
Fix azure provider warning, rename a public_ip field * azurerm_public_ip (used internally) added a field `allocation_method` to replace the field `public_ip_address_allocation` (deprecated) * Require terraform-provider-azurerm v1.21+ * https://github.com/terraform-providers/terraform-provider-azurerm/pull/2576
2019-01-28 02:52:35 +01:00
#### Azure
* Fix azure provider warning, `public_ip` `allocation_method` replaces `public_ip_address_allocation`
* Require `terraform-provider-azurerm` v1.21+ (action required)
Update kube-state-metrics exporter from v1.4.0 to v1.5.0 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.5.0
2019-01-12 23:23:34 +01:00
#### Addons
Update nginx-ingress from v0.21.0 to v0.22.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.22.0
2019-01-17 07:59:46 +01:00
* Update nginx-ingress from v0.21.0 to v0.22.0
Update Prometheus from v2.7.0 to v2.7.1 * https://github.com/prometheus/prometheus/releases/tag/v2.7.1
2019-02-02 09:13:24 +01:00
* Update Prometheus from v2.6.0 to v2.7.1
Update kube-state-metrics exporter from v1.4.0 to v1.5.0 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.5.0
2019-01-12 23:23:34 +01:00
* Update kube-state-metrics from v1.4.0 to v1.5.0
Allow kube-state-metrics PodDisruptionBudget metrics * Update kube-state-metrics ClusterRole to allow collecting poddisruptionbudget metrics (exported as kube_poddisruptionbudget_*) * https://github.com/kubernetes/kube-state-metrics/pull/551 * Bump addon-resizer from v1.7 to v1.8.4
2019-01-22 05:07:31 +01:00
* Fix ClusterRole to collect and export PodDisruptionBudget metrics ([#383](https://github.com/poseidon/typhoon/pull/383))
Update node-exporter from v0.15.2 to v0.17.0 * node-exporter renamed multiple metrics that are reflected in changes to Prometheus rules and Grafana dashboard expressions
2019-01-22 09:19:55 +01:00
* Update node-exporter from v0.15.2 to v0.17.0
Update Grafana from v5.4.2 to v5.4.3 * https://github.com/grafana/grafana/releases/tag/v5.4.3
2019-01-16 06:05:46 +01:00
* Update Grafana from v5.4.2 to v5.4.3
Update kube-state-metrics exporter from v1.4.0 to v1.5.0 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.5.0
2019-01-12 23:23:34 +01:00
Update etcd from v3.3.10 to v3.3.11 * https://github.com/etcd-io/etcd/releases/tag/v3.3.11
2019-01-12 09:20:47 +01:00
## v1.13.2
Update Kubernetes from v1.13.1 to v1.13.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1132
2019-01-11 08:21:21 +01:00
* Kubernetes [v1.13.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1132)
Use a lower-privilege Kubelet kubeconfig in system:nodes * Kubelets can use a lower-privilege TLS client certificate with Org system:nodes and a binding to the system:node ClusterRole * Admin kubeconfig's continue to belong to Org system:masters to provide cluster-admin (available in assets/auth/kubeconfig or as a Terraform output kubeconfig-admin) * Remove bare-metal output variable kubeconfig
2019-01-03 08:30:42 +01:00
* Add ServiceAccounts for `kube-apiserver` and `kube-scheduler` ([#370](https://github.com/poseidon/typhoon/pull/370))
Update Kubernetes from v1.13.1 to v1.13.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1132
2019-01-11 08:21:21 +01:00
* Use lower-privilege TLS client certificates for Kubelets ([#372](https://github.com/poseidon/typhoon/pull/372))
* Use HTTPS liveness probes for `kube-scheduler` and `kube-controller-manager` ([#377](https://github.com/poseidon/typhoon/pull/377))
* Update CoreDNS from v1.2.6 to [v1.3.0](https://coredns.io/2018/12/15/coredns-1.3.0-release/)
Enable the certificates.k8s.io API to issue cluster certificates * System components that require certificates signed by the cluster CA can submit a CSR to the apiserver, have an administrator inspect and approve it, and be issued a certificate * Configure kube-controller-manager to sign Approved CSR's using the cluster CA private key * Admins are responsible for approving or denying CSRs, otherwise, no certificate is issued. Read the Kubernetes docs carefully and verify the entity making the request and the authorization level * https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster
2019-01-07 02:23:58 +01:00
* Allow the `certificates.k8s.io` API to issue certificates signed by the cluster CA ([#376](https://github.com/poseidon/typhoon/pull/376))
* Configure controller manager to sign CSRs that are manually [approved](https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster) by an administrator
Add ServiceAccounts for kube-apiserver and kube-scheduler * Add ServiceAccounts and ClusterRoleBindings for kube-apiserver and kube-scheduler * Remove the ClusterRoleBinding for the kube-system default ServiceAccount * Rename the CA certificate CommonName for consistency with upstream
2019-01-02 03:40:11 +01:00
Change AWS default type from t2.small to t3.small * T3 is the next generation general purpose burstable instance type. Compared with t2.small, the t3.small is cheaper, has 2 vCPU (instead of 1) and provides 5 Gbps of pod-to-pod bandwidth (instead of 1 Gbps)
2018-12-18 21:29:27 +01:00
#### AWS
Change AWS worker modules' default type from t2.small to t3.small * Worker instance types weren't updated in #365
2019-01-12 09:07:48 +01:00
* Change `controller_type` and `worker_type` default from t2.small to t3.small ([#365](https://github.com/poseidon/typhoon/pull/365))
Change AWS default type from t2.small to t3.small * T3 is the next generation general purpose burstable instance type. Compared with t2.small, the t3.small is cheaper, has 2 vCPU (instead of 1) and provides 5 Gbps of pod-to-pod bandwidth (instead of 1 Gbps)
2018-12-18 21:29:27 +01:00
* t3.small is cheaper, provides 2 vCPU (instead of 1), and 5 Gbps of pod-to-pod bandwidth!
Use a lower-privilege Kubelet kubeconfig in system:nodes * Kubelets can use a lower-privilege TLS client certificate with Org system:nodes and a binding to the system:node ClusterRole * Admin kubeconfig's continue to belong to Org system:masters to provide cluster-admin (available in assets/auth/kubeconfig or as a Terraform output kubeconfig-admin) * Remove bare-metal output variable kubeconfig
2019-01-03 08:30:42 +01:00
#### Bare-Metal
* Remove the `kubeconfig` output variable
Update Prometheus addon from v2.5.0 to v2.6.0 * https://github.com/prometheus/prometheus/releases/tag/v2.6.0
2018-12-27 16:35:12 +01:00
#### Addons
* Update Prometheus from v2.5.0 to v2.6.0
Update changelog for v1.13.1 release
2018-12-17 23:28:27 +01:00
## v1.13.1
Update Kubernetes from v1.13.0 to v1.13.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1131
2018-12-15 20:43:44 +01:00
* Kubernetes [v1.13.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1131)
Update terraform-provider-ct plugin from v0.2.1 to v0.3.0 * Provide migration instructions for upgrading terraform-provider-ct in-place for v1.12.2+ clusters * Require switching from ~/.terraformrc to the Terraform third-party plugins directory ~/.terraform.d/plugins/ * Require Container Linux 1688.5.3 or newer
2018-12-17 23:13:50 +01:00
* Update Calico from v3.3.2 to [v3.4.0](https://docs.projectcalico.org/v3.4/releases/) ([#362](https://github.com/poseidon/typhoon/pull/362))
Update Calico from v3.3.2 to v3.4.0 * https://docs.projectcalico.org/v3.4/releases/
2018-12-16 02:41:25 +01:00
* Install CNI plugins with an init container rather than a sidecar
* Improve the `calico-node` ClusterRole
Update terraform-provider-ct plugin from v0.2.1 to v0.3.0 * Provide migration instructions for upgrading terraform-provider-ct in-place for v1.12.2+ clusters * Require switching from ~/.terraformrc to the Terraform third-party plugins directory ~/.terraform.d/plugins/ * Require Container Linux 1688.5.3 or newer
2018-12-17 23:13:50 +01:00
* Recommend updating `terraform-provider-ct` plugin from v0.2.1 to v0.3.0 ([#363](https://github.com/poseidon/typhoon/pull/363))
* [Migration](https://typhoon.psdn.io/topics/maintenance/#upgrade-terraform-provider-ct) instructions for upgrading `terraform-provider-ct` in-place for v1.12.2+ clusters (**action required**)
* [Require](https://typhoon.psdn.io/topics/maintenance/#terraform-plugins-directory) switching from `~/.terraformrc` to the Terraform [third-party plugins](https://www.terraform.io/docs/configuration/providers.html#third-party-plugins) directory `~/.terraform.d/plugins/`
* Require Container Linux 1688.5.3 or newer
Update Kubernetes from v1.13.0 to v1.13.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1131
2018-12-15 20:43:44 +01:00
Increase GCP TCP proxy apiserver backend timeout to 5 minutes * On GCP, kubectl port-forward connections to pods are closed after a timeout (unlike AWS NLB's or Azure load balancers) * Increase the GCP apiserver backend service timeout from 1 minute to 5 minutes to be more similar to AWS/Azure LB behavior
2018-12-15 23:20:53 +01:00
#### Google Cloud
* Increase TCP proxy apiserver backend service timeout from 1 minute to 5 minutes ([#361](https://github.com/poseidon/typhoon/pull/361))
* Align `port-forward` behavior closer to AWS/Azure (no timeout)
Update Grafana from v5.4.0 to v5.4.2 * https://github.com/grafana/grafana/releases/tag/v5.4.2 * https://github.com/grafana/grafana/releases/tag/v5.4.1
2018-12-15 21:39:03 +01:00
#### Addons
* Update Grafana from v5.4.0 to v5.4.2
Update Kubernetes from v1.13.0 to v1.13.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1131
2018-12-15 20:43:44 +01:00
## v1.13.0
Update Kubernetes from v1.12.3 to v1.13.0
2018-12-04 05:44:32 +01:00
* Kubernetes [v1.13.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1130)
Update Calico from v3.3.1 to v3.3.2 * https://docs.projectcalico.org/v3.3/releases/
2018-12-07 07:56:55 +01:00
* Update Calico from v3.3.1 to [v3.3.2](https://docs.projectcalico.org/v3.3/releases/)
Update Kubernetes from v1.12.3 to v1.13.0
2018-12-04 05:44:32 +01:00
Disable Grafana login form, admin user can't be disabled * Example manifests aim to provide a read-only dashboard visible to any users with network access (i.e. kubectl port-forward, LAN) * Problem: Grafana always has an admin user, even with the user management system disabled * Disable the login form to prevent admin login
2018-11-29 06:56:34 +01:00
#### Addons
Update Grafana from v5.3.4 to v5.4.0 * https://github.com/grafana/grafana/releases/tag/v5.4.0
2018-12-06 10:33:50 +01:00
* Update Grafana from v5.3.4 to v5.4.0
Disable Grafana login form, admin user can't be disabled * Example manifests aim to provide a read-only dashboard visible to any users with network access (i.e. kubectl port-forward, LAN) * Problem: Grafana always has an admin user, even with the user management system disabled * Disable the login form to prevent admin login
2018-11-29 06:56:34 +01:00
* Disable Grafana login form, since admin user can't be disabled ([#352](https://github.com/poseidon/typhoon/pull/352))
* Example manifests aim to provide a read-only dashboard view
Update CHANGES changelog for release
2018-11-28 18:23:13 +01:00
## v1.12.3
Update Kubernetes from v1.12.2 to v1.12.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md/#v1123
2018-11-27 06:02:59 +01:00
* Kubernetes [v1.12.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md#v1123)
* Add `enable_reporting` variable (default "false") to provide upstreams with usage data ([#345](https://github.com/poseidon/typhoon/pull/345))
Set kube-apiserver kubelet preferred address types * Prefer InternalIP and ExternalIP over the node's hostname, to match upstream behavior and kubeadm * Previously, hostname-override was used to set node names to internal IP's to work around some cloud providers not resolving hostnames for instances (e.g. DO droplets)
2018-11-03 23:04:08 +01:00
* Change kube-apiserver `--kubelet-preferred-address-types` to InternalIP,ExternalIP,Hostname
Update Calico from v3.3.0 to v3.3.1 * Structure Calico and flannel manifests * Rename kube-flannel mentions to just flannel
2018-11-10 22:35:35 +01:00
* Update Calico from v3.3.0 to [v3.3.1](https://docs.projectcalico.org/v3.3/releases/)
Fix Calico Felix reporting usage data, require opt-in * Calico Felix has been reporting anonymous usage data about the version and cluster size, which violates Typhoon's privacy policy where analytics should be opt-in only * Add a variable enable_reporting (default: false) to allow opting in to reporting usage data to Calico (or future components)
2018-11-20 07:45:02 +01:00
* Disable Felix usage reporting by default ([#345](https://github.com/poseidon/typhoon/pull/345))
Add flannel resource request and mount only /run/flannel
2018-11-12 00:57:20 +01:00
* Improve flannel manifests
* [Rename](https://github.com/poseidon/terraform-render-bootkube/commit/d045a8e6b8eccfbb9d69bb51953b5a93d23f67f7) `kube-flannel` DaemonSet to `flannel` and `kube-flannel-cfg` ConfigMap to `flannel-config`
Measure DigitalOcean network performance * Measuring pod-to-pod bandwidth in a few regions (NYC3, FRA1, SFO1) shows DigitalOcean has made some improvements
2018-11-12 06:05:07 +01:00
* [Drop](https://github.com/poseidon/terraform-render-bootkube/commit/39f9afb3360ec642e5b98457c8bd07eda35b6c96) unused mounts and add a CPU resource request
Update CoreDNS from v1.2.4 to v1.2.6 * https://coredns.io/2018/11/05/coredns-1.2.6-release/
2018-11-19 01:45:53 +01:00
* Update CoreDNS from v1.2.4 to [v1.2.6](https://coredns.io/2018/11/05/coredns-1.2.6-release/)
* Enable CoreDNS `loop` and `loadbalance` plugins ([#340](https://github.com/poseidon/typhoon/pull/340))
Update Kubernetes from v1.12.2 to v1.12.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md/#v1123
2018-11-27 06:02:59 +01:00
* Fix pod-checkpointer log noise and checkpointable pods detection ([#346](https://github.com/poseidon/typhoon/pull/346))
Update bootkube image version from v0.13.0 to v0.14.0 * https://github.com/kubernetes-incubator/bootkube/releases/tag/v0.14.0
2018-11-07 08:35:11 +01:00
* Use kubernetes-incubator/bootkube v0.14.0
Recommend switch from ~/.terraformrc to 3rd-party plugin dir * Switch tutorials from using ~/.terraformrc to using the 3rd-party plugin directory so 3rd-party plugins can be pinned * Continue to show using terraform-provider-ct v0.2.2. Updating to a newer version is only safe once all managed clusters are v1.12.2 or higher
2018-11-27 09:08:51 +01:00
* [Recommend](https://typhoon.psdn.io/topics/maintenance/#terraform-plugins-directory) switching from `~/.terraformrc` to the Terraform [third-party plugins](https://www.terraform.io/docs/configuration/providers.html#third-party-plugins) directory `~/.terraform.d/plugins/`.
* Allows pinning `terraform-provider-ct` and `terraform-provider-matchbox` versions
* Improves safety of later plugin version migrations
Set kube-apiserver kubelet preferred address types * Prefer InternalIP and ExternalIP over the node's hostname, to match upstream behavior and kubeadm * Previously, hostname-override was used to set node names to internal IP's to work around some cloud providers not resolving hostnames for instances (e.g. DO droplets)
2018-11-03 23:04:08 +01:00
Use eviction policy Delete for Low priority VMSS workers * Fix issue where Azure defaults to Deallocate eviction policy, which required manually restarting deallocated workers * Require terraform-provider-azurerm v1.19+ to support setting the eviction_policy
2018-11-19 01:57:54 +01:00
#### Azure
* Use eviction policy `Delete` for `Low` priority virtual machine scale set workers ([#343](https://github.com/poseidon/typhoon/pull/343))
* Fix issue where Azure defaults to `Deallocate` eviction policy, which required manually restarting deallocated instances. `Delete` policy aligns Azure with AWS and GCP behavior.
* Require `terraform-provider-azurerm` v1.19+ (action required)
Add Kubelet /etc/iscsi and iscsiadm mounts on bare-metal * Allow using iSCSI with Container Linux bare-metal clusters * Warning, iSCSI isn't part of Kubernetes conformance and isn't regularly evaluated
2018-01-19 20:34:47 +01:00
#### Bare-Metal
* Add Kubelet `/etc/iscsi` and `iscsadm` mounts on bare-metal for iSCSI ([#103](https://github.com/poseidon/typhoon/pull/103))
Update Prometheus from v2.4.3 to v2.5.0 * https://github.com/prometheus/prometheus/releases/tag/v2.5.0
2018-11-07 07:16:12 +01:00
#### Addons
Update ngninx-ingress from v0.20.0 to v0.21.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.21.0
2018-11-27 06:57:34 +01:00
* Update nginx-ingress from v0.20.0 to v0.21.0
Update Prometheus from v2.4.3 to v2.5.0 * https://github.com/prometheus/prometheus/releases/tag/v2.5.0
2018-11-07 07:16:12 +01:00
* Update Prometheus from v2.4.3 to v2.5.0
Update Grafana from v5.3.2 to v5.3.4 * https://github.com/grafana/grafana/releases/tag/v5.3.3 * https://github.com/grafana/grafana/releases/tag/v5.3.4
2018-11-19 01:42:50 +01:00
* Update Grafana from v5.3.2 to v5.3.4
Update Prometheus from v2.4.3 to v2.5.0 * https://github.com/prometheus/prometheus/releases/tag/v2.5.0
2018-11-07 07:16:12 +01:00
Update Kubernetes from v1.12.1 to v1.12.2 * Update CoreDNS from v1.2.2 to v1.2.4 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md#v1122 * https://coredns.io/2018/10/17/coredns-1.2.4-release/ * https://coredns.io/2018/10/16/coredns-1.2.3-release/
2018-10-28 00:47:57 +02:00
## v1.12.2
* Kubernetes [v1.12.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md#v1122)
* Update CoreDNS from 1.2.2 to [1.2.4](https://github.com/coredns/coredns/releases/tag/v1.2.4)
Update Calico from v3.2.3 to v3.3.0 * https://docs.projectcalico.org/v3.3/releases/
2018-10-24 05:30:30 +02:00
* Update Calico from v3.2.3 to [v3.3.0](https://docs.projectcalico.org/v3.3/releases/)
Disable Kubelet read-only port 10255 * We can finally disable the Kubelet read-only port 10255! * Journey: https://github.com/poseidon/typhoon/issues/322#issuecomment-431073073
2018-05-14 03:16:10 +02:00
* Disable Kubelet read-only port ([#324](https://github.com/poseidon/typhoon/pull/324))
Update Calico from v3.2.3 to v3.3.0 * https://docs.projectcalico.org/v3.3/releases/
2018-10-24 05:30:30 +02:00
* Fix CoreDNS AntiAffinity spec to prefer spreading replicas
Ignore controller user_data changes to allow plugin updates * Updating the `terraform-provider-ct` plugin is known to produce a `user_data` diff in all pre-existing clusters. Applying the diff to pre-existing cluster destroys controller nodes * Ignore changes to controller `user_data`. Once all managed clusters use a release containing this change, it is possible to update the `terraform-provider-ct` plugin (worker `user_data` will still be modified) * Changing the module `ref` for an existing cluster and re-applying is still NOT supported (although this PR would protect controllers from being destroyed)
2018-10-28 23:11:47 +01:00
* Ignore controller node user-data changes ([#335](https://github.com/poseidon/typhoon/pull/335))
* Once all managed clusters use v1.12.2, it is possible to update `terraform-provider-ct`
Fix CoreDNS AntiAffinity spec to prefer spreading replicas * Pods were still being scheduled at random due to a typo
2018-10-18 07:19:57 +02:00
Add disk_iops variable for AWS * Setting disk_iops is required for disk_type io1 * https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html#EBSVolumeTypes
2018-10-15 16:59:35 +02:00
#### AWS
* Add `disk_iops` variable for EBS volume IOPS ([#314](https://github.com/poseidon/typhoon/pull/314))
Add primary field to ip_configuration required by Azure * Required by terraform-provider-azurerm v1.17+ * https://github.com/terraform-providers/terraform-provider-azurerm/pull/2035
2018-10-28 01:42:36 +02:00
#### Azure
Use new azurerm_network_interface_backend_address_pool_association * Require terraform-provider-azurerm v1.17+ * Inline load_balancer_backend_address_pools_ids is deprecated and scheduled for removal in the v2.0 provider * https://github.com/terraform-providers/terraform-provider-azurerm/pull/2079
2018-10-28 06:46:10 +01:00
* Use new `azurerm_network_interface_backend_address_pool_association` ([#332](https://github.com/poseidon/typhoon/pull/332))
* Require `terraform-provider-azurerm` v1.17+ (action required)
* Add `primary` field to `ip_configuration` needed by v1.17+ ([#331](https://github.com/poseidon/typhoon/pull/331))
Add primary field to ip_configuration required by Azure * Required by terraform-provider-azurerm v1.17+ * https://github.com/terraform-providers/terraform-provider-azurerm/pull/2035
2018-10-28 01:42:36 +02:00
Add DigitalOcean AAAA DNS records resolving to workers * Improve the workers "round-robin" DNS FQDN that is created with each cluster by adding AAAA records * CNAME's resolving to the DigitalOcean `workers_dns` output can be followed to find a droplet's IPv4 or IPv6 address * The CNI portmap plugin doesn't support IPv6. Hosting IPv6 apps is possible, but requires editing the nginx-ingress addon with `hostNetwork: true`
2018-10-28 07:01:50 +01:00
#### DigitalOcean
* Add AAAA DNS records resolving to worker nodes ([#333](https://github.com/poseidon/typhoon/pull/333))
* Hosting IPv6 apps requires editing nginx-ingress with `hostNetwork: true`
Add an IPv6 address and forwarding rules on Google Cloud * Allowing serving IPv6 applications via Kubernetes Ingress on Typhoon Google Cloud clusters * Add `ingress_static_ipv6` output variable for use in AAAA DNS records
2018-10-28 22:17:12 +01:00
#### Google Cloud
Ignore controller user_data changes to allow plugin updates * Updating the `terraform-provider-ct` plugin is known to produce a `user_data` diff in all pre-existing clusters. Applying the diff to pre-existing cluster destroys controller nodes * Ignore changes to controller `user_data`. Once all managed clusters use a release containing this change, it is possible to update the `terraform-provider-ct` plugin (worker `user_data` will still be modified) * Changing the module `ref` for an existing cluster and re-applying is still NOT supported (although this PR would protect controllers from being destroyed)
2018-10-28 23:11:47 +01:00
* Add an IPv6 address and IPv6 forwarding rules for load balancing IPv6 Ingress ([#334](https://github.com/poseidon/typhoon/pull/334))
Add an IPv6 address and forwarding rules on Google Cloud * Allowing serving IPv6 applications via Kubernetes Ingress on Typhoon Google Cloud clusters * Add `ingress_static_ipv6` output variable for use in AAAA DNS records
2018-10-28 22:17:12 +01:00
* Add `ingress_static_ipv6` output variable for use in AAAA DNS records
* Allow serving IPv6 applications via Kubernetes Ingress
Configure Heapster to source metrics from Kubelet authenticated API * Heapster can now get nodes (i.e. kubelets) from the apiserver and source metrics from the Kubelet authenticated API (10250) instead of the Kubelet HTTP read-only API (10255) * https://github.com/kubernetes/heapster/blob/master/docs/source-configuration.md * Use the heapster service account token via Kubelet bearer token authn/authz. * Permit Heapster to skip CA verification. The CA cert does not contain IP SANs and cannot since nodes get random IPs that aren't known upfront. Heapster obtains the node list from the apiserver, so the risk of spoofing a node is limited. For the same reason, Prometheus scrapes must skip CA verification for scraping Kubelet's provided by the apiserver. * https://github.com/poseidon/typhoon/blob/v1.12.1/addons/prometheus/config.yaml#L68 * Create a heapster ClusterRole to work around the default Kubernetes `system:heapster` ClusterRole lacking the proper GET `nodes/stats` access. See https://github.com/kubernetes/heapster/issues/1936
2018-10-19 05:39:30 +02:00
#### Addons
* Configure Heapster to scrape Kubelets with bearer token auth ([#323](https://github.com/poseidon/typhoon/pull/323))
Update Grafana from v5.3.1 to v5.3.2 * https://github.com/grafana/grafana/releases/tag/v5.3.2
2018-10-29 03:44:22 +01:00
* Update Grafana from v5.3.1 to v5.3.2
Configure Heapster to source metrics from Kubelet authenticated API * Heapster can now get nodes (i.e. kubelets) from the apiserver and source metrics from the Kubelet authenticated API (10250) instead of the Kubelet HTTP read-only API (10255) * https://github.com/kubernetes/heapster/blob/master/docs/source-configuration.md * Use the heapster service account token via Kubelet bearer token authn/authz. * Permit Heapster to skip CA verification. The CA cert does not contain IP SANs and cannot since nodes get random IPs that aren't known upfront. Heapster obtains the node list from the apiserver, so the risk of spoofing a node is limited. For the same reason, Prometheus scrapes must skip CA verification for scraping Kubelet's provided by the apiserver. * https://github.com/poseidon/typhoon/blob/v1.12.1/addons/prometheus/config.yaml#L68 * Create a heapster ClusterRole to work around the default Kubernetes `system:heapster` ClusterRole lacking the proper GET `nodes/stats` access. See https://github.com/kubernetes/heapster/issues/1936
2018-10-19 05:39:30 +02:00
Add links to header to CHANGES
2018-10-17 17:53:23 +02:00
## v1.12.1
Update Kubernetes from v1.11.3 to v1.12.1 * Mount an empty dir for the controller-manager to work around https://github.com/kubernetes/kubernetes/issues/68973 * Update coreos/pod-checkpointer to strip affinity from checkpointed pod manifests. Kubernetes v1.12.0-rc.1 introduced a default affinity that appears on checkpointed manifests; but it prevented scheduling and checkpointed pods should not have an affinity, they're run directly by the Kubelet on the local node * https://github.com/kubernetes-incubator/bootkube/issues/1001 * https://github.com/kubernetes/kubernetes/pull/68173
2018-09-22 09:02:37 +02:00
* Kubernetes [v1.12.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.12.md#v1121)
Update etcd from v3.3.9 to v3.3.10 * https://github.com/etcd-io/etcd/blob/master/CHANGELOG-3.3.md#v3310-2018-10-10
2018-10-13 22:14:37 +02:00
* Update etcd from v3.3.9 to [v3.3.10](https://github.com/etcd-io/etcd/blob/master/CHANGELOG-3.3.md#v3310-2018-10-10)
Add links to header to CHANGES
2018-10-17 17:53:23 +02:00
* Update CoreDNS from 1.1.3 to [1.2.2](https://github.com/coredns/coredns/releases/tag/v1.2.2)
* Update Calico from v3.2.1 to [v3.2.3](https://docs.projectcalico.org/v3.2/releases/)
* Raise scheduler and controller-manager replicas to the larger of 2 or the number of controller nodes ([#312](https://github.com/poseidon/typhoon/pull/312))
Raise scheduler/controller-manager replicas in multi-master * Continue to ensure scheduler and controller-manager run at least two replicas to support performing kubectl edits on single-master clusters (no change) * For multi-master clusters, set scheduler / controller-manager replica count to the number of masters (e.g. a 3-master cluster previously used replicas:2, now replicas:3)
2018-10-13 22:16:18 +02:00
* Single-controller clusters continue to run 2 replicas as before
Add links to header to CHANGES
2018-10-17 17:53:23 +02:00
* Raise default CoreDNS replicas to the larger of 2 or the number of controller nodes ([#313](https://github.com/poseidon/typhoon/pull/313))
Raise CoreDNS replica count to 2 or more * Run at least two replicas of CoreDNS to better support rolling updates (previously, kube-dns had a pod nanny) * On multi-master clusters, set the CoreDNS replica count to match the number of masters (e.g. a 3-master cluster previously used replicas:1, now replicas:3) * Add AntiAffinity preferred rule to favor distributing CoreDNS pods across controller nodes nodes
2018-10-14 01:21:22 +02:00
* Add AntiAffinity preferred rule to favor spreading CoreDNS pods
Add links to header to CHANGES
2018-10-17 17:53:23 +02:00
* Annotate control plane and addon containers to use the Docker runtime seccomp profile ([#319](https://github.com/poseidon/typhoon/pull/319))
* Override Kubernetes default behavior that starts containers with `seccomp=unconfined`
Update CoreDNS and Calico versions * Update CoreDNS from 1.1.3 to 1.2.2 * Update Calico from v3.2.1 to v3.2.3
2018-10-02 16:06:41 +02:00
Remove Azure admin_password (disabled) now that its optional * Requires terraform-provider-azurerm v1.16.0 or higher https://github.com/terraform-providers/terraform-provider-azurerm/pull/1958
2018-10-14 06:55:46 +02:00
#### Azure
Add links to header to CHANGES
2018-10-17 17:53:23 +02:00
* Remove `admin_password` field (disabled) since it is now optional
Remove Azure admin_password (disabled) now that its optional * Requires terraform-provider-azurerm v1.16.0 or higher https://github.com/terraform-providers/terraform-provider-azurerm/pull/1958
2018-10-14 06:55:46 +02:00
* Require `terraform-provider-azurerm` v1.16+ (action required)
Add support for Flatcar Linux bare-metal cached_install * Support bare-metal cached_install=true mode with Flatcar Linux where assets are fetched from the Matchbox assets cache instead of from the upstream Flatcar download server * Skipped in original Flatcar support to keep it simple https://github.com/poseidon/typhoon/pull/209
2018-10-15 11:27:32 +02:00
#### Bare-Metal
* Add support for `cached_install` mode with Flatcar Linux ([#315](https://github.com/poseidon/typhoon/pull/315))
Require terraform-provider-digitalocean plugin ~> 1.0 * Require a terraform-provider-digitalocean plugin version of 1.0 or higher within the same major version (e.g. allow 1.1 but not 2.0) * Change requirement from ~> 0.1.2 (which allowed up to but not including 1.0 release)
2018-10-02 16:41:53 +02:00
#### DigitalOcean
Remove Azure admin_password (disabled) now that its optional * Requires terraform-provider-azurerm v1.16.0 or higher https://github.com/terraform-providers/terraform-provider-azurerm/pull/1958
2018-10-14 06:55:46 +02:00
* Require `terraform-provider-digitalocean` v1.0+ (action required)
Require terraform-provider-digitalocean plugin ~> 1.0 * Require a terraform-provider-digitalocean plugin version of 1.0 or higher within the same major version (e.g. allow 1.1 but not 2.0) * Change requirement from ~> 0.1.2 (which allowed up to but not including 1.0 release)
2018-10-02 16:41:53 +02:00
Update Prometheus from v2.3.2 to v2.4.2 * https://github.com/prometheus/prometheus/releases/tag/v2.4.0 * https://github.com/prometheus/prometheus/releases/tag/v2.4.1 * https://github.com/prometheus/prometheus/releases/tag/v2.4.2
2018-09-22 07:22:21 +02:00
#### Addons
Update nginx-ingress from v0.19.0 to v0.20.0
2018-10-17 06:34:17 +02:00
* Update nginx-ingress from v0.19.0 to v0.20.0
Update Prometheus from v2.4.2 to v2.4.3 * https://github.com/prometheus/prometheus/releases/tag/v2.4.3
2018-10-17 06:29:41 +02:00
* Update Prometheus from v2.3.2 to v2.4.3
Update Grafana from v5.3.0 to v5.3.1 * https://github.com/grafana/grafana/releases/tag/v5.3.1
2018-10-17 06:23:44 +02:00
* Update Grafana from v5.2.4 to v5.3.1
Update Prometheus from v2.3.2 to v2.4.2 * https://github.com/prometheus/prometheus/releases/tag/v2.4.0 * https://github.com/prometheus/prometheus/releases/tag/v2.4.1 * https://github.com/prometheus/prometheus/releases/tag/v2.4.2
2018-09-22 07:22:21 +02:00
Update Kubernetes from v1.11.2 to v1.11.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1113
2018-09-14 03:48:07 +02:00
## v1.11.3
* Kubernetes [v1.11.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1113)
Add docs for Azure Ingress and worker pools * Azure worker pools must be in the same region as the cluster itself unfortunately
2018-08-28 07:24:52 +02:00
* Introduce Typhoon for Azure as alpha ([#288](https://github.com/poseidon/typhoon/pull/288))
* Special thanks @justaugustus for an earlier variant
Update Calico from v3.1.3 to v3.2.1 * Add new bird and felix readiness checks * Read MTU from ConfigMap veth_mtu * Add RBAC read for serviceaccounts * Remove invalid description from CRDs
2018-08-15 08:49:33 +02:00
* Update Calico from v3.1.3 to v3.2.1 ([#278](https://github.com/poseidon/typhoon/pull/278))
Remove AWS security rule allowing ICMP packets to nodes * Deny ICMP packets for consistency across Typhoon clusters on various clouds and because there isn't much need to allow them
2018-08-22 06:16:16 +02:00
#### AWS
Fix docs mentions of ELBs to NLBs * Typhoon AWS clusters use an NLB rather than an ELB, since v1.10.5 * Add a few missing links in CHANGES
2018-08-22 06:25:22 +02:00
* Remove firewall rule allowing ICMP packets to nodes ([#285](https://github.com/poseidon/typhoon/pull/285))
Remove AWS security rule allowing ICMP packets to nodes * Deny ICMP packets for consistency across Typhoon clusters on various clouds and because there isn't much need to allow them
2018-08-22 06:16:16 +02:00
Remove unofficial bare-metal *_networkds variables * Remove controller_networkds and worker_networkds variables. These variables were always listed as experimental, unsupported, and excluded from documentation in anticipation of Container Linux Config snippets * Use Container Linux Config snippets on bare-metal instead. They provide safer, more powerful, and more elegant host customization
2018-08-13 01:44:13 +02:00
#### Bare-Metal
* Remove `controller_networkds` and `worker_networkds` variables. Use Container Linux Config snippets [#277](https://github.com/poseidon/typhoon/pull/277)
Remove GCP firewall rule allowing Nginx Ingress health * Nginx Ingress addon no longer uses hostNework so Prometheus may scrape port 10254 via the CNI network, rather than via the host address
2018-08-22 06:06:03 +02:00
#### Google Cloud
Fix firewall to allow etcd client traffic between controllers * Broaden internal-etcd firewall rule to allow etcd client traffic (2379) from other controller nodes * Previously, kube-apiservers were only able to connect to their node's local etcd peer. While master node outages were tolerated, reaching a healthy peer took longer than neccessary in some cases * Reduce time needed to bootstrap a cluster
2018-08-22 08:21:05 +02:00
* Fix firewall to allow etcd client port 2379 traffic between controller nodes ([#287](https://github.com/poseidon/typhoon/pull/287))
* kube-apiservers were only able to connect to their node's local etcd peer. While master node outages were tolerated, reaching a healthy peer took longer than neccessary in some cases
* Reduce time needed to bootstrap the cluster
Fix docs mentions of ELBs to NLBs * Typhoon AWS clusters use an NLB rather than an ELB, since v1.10.5 * Add a few missing links in CHANGES
2018-08-22 06:25:22 +02:00
* Remove firewall rule allowing workers to access Nginx Ingress health check ([#284](https://github.com/poseidon/typhoon/pull/284))
Remove GCP firewall rule allowing Nginx Ingress health * Nginx Ingress addon no longer uses hostNework so Prometheus may scrape port 10254 via the CNI network, rather than via the host address
2018-08-22 06:06:03 +02:00
* Nginx Ingress addon no longer uses hostNetwork, Prometheus scrapes via CNI network
Update kube-state-metrics from v1.3.1 to v1.4.0
2018-08-29 18:36:47 +02:00
#### Addons
Update nginx-ingress from 0.17.1 to 0.19.0 * If using --enable-ssl-passthrough or exposing TCP/UDP services, be aware of https://github.com/kubernetes/ingress-nginx/pull/3038 * Workarounds until the fix merges are to stay on 0.17.1, use the suggested development image, or revert to securityContext `runAsNonRoot: false` for a while (less secure)
2018-09-09 01:12:38 +02:00
* Update nginx-ingress from 0.17.1 to 0.19.0
Update kube-state-metrics from v1.3.1 to v1.4.0
2018-08-29 18:36:47 +02:00
* Update kube-state-metrics from v1.3.1 to v1.4.0
Update Grafana from v5.2.2 to v5.2.4 * https://github.com/grafana/grafana/releases/tag/v5.2.3 * https://github.com/grafana/grafana/releases/tag/v5.2.4
2018-09-09 00:41:20 +02:00
* Update Grafana from 5.2.2 to 5.2.4
Update kube-state-metrics from v1.3.1 to v1.4.0
2018-08-29 18:36:47 +02:00
Update Kubernetes from v1.11.1 to v1.11.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1112
2018-08-08 06:56:02 +02:00
## v1.11.2
Update etcd from v3.3.4 to v3.3.5 * https://github.com/coreos/etcd/releases/tag/v3.3.5
2018-05-10 10:01:25 +02:00
Update Kubernetes from v1.11.1 to v1.11.2 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1112
2018-08-08 06:56:02 +02:00
* Kubernetes [v1.11.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1112)
Update etcd from v3.3.8 to v3.3.9 * https://github.com/coreos/etcd/blob/master/CHANGELOG-3.3.md#v339-2018-07-24
2018-07-29 20:27:37 +02:00
* Update etcd from v3.3.8 to [v3.3.9](https://github.com/coreos/etcd/blob/master/CHANGELOG-3.3.md#v339-2018-07-24)
Update from bootkube v0.12.0 to v0.13.0
2018-07-29 20:20:17 +02:00
* Use kubernetes-incubator/bootkube v0.13.0
Fix Kublet version for Fedora Atomic modules * Release v1.11.1 erroneously left Fedora Atomic clusters using the v1.11.0 Kubelet. The rest of the control plane ran v1.11.1 as expected * Update Kubelet from v1.11.0 to v1.11.1 so Fedora Atomic matches Container Linux * Container Linux modules were not affected
2018-07-29 21:13:29 +02:00
* Fix Fedora Atomic modules' Kubelet version ([#270](https://github.com/poseidon/typhoon/issues/270))
Update from bootkube v0.12.0 to v0.13.0
2018-07-29 20:20:17 +02:00
Support Container Linux Config snippets on bare-metal
2018-07-26 07:44:07 +02:00
#### Bare-Metal
* Introduce [Container Linux Config snippets](https://typhoon.psdn.io/advanced/customization/#container-linux) on bare-metal
* Validate and additively merge custom Container Linux Configs during terraform plan
* Define files, systemd units, dropins, networkd configs, mounts, users, and more
Fix docs mentions of ELBs to NLBs * Typhoon AWS clusters use an NLB rather than an ELB, since v1.10.5 * Add a few missing links in CHANGES
2018-08-22 06:25:22 +02:00
* [Require](https://typhoon.psdn.io/cl/bare-metal/#terraform-setup) `terraform-provider-ct` plugin v0.2.1 (**action required!**)
Support Container Linux Config snippets on bare-metal
2018-07-26 07:44:07 +02:00
Update Grafana from v5.2.1 to v5.2.2 * https://github.com/grafana/grafana/releases/tag/v5.2.2
2018-07-29 20:12:56 +02:00
#### Addons
Update nginx-ingress from 0.16.2 to 0.17.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.17.1 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.17.0
2018-08-08 09:45:20 +02:00
* Update nginx-ingress from 0.16.2 to 0.17.1
Add nginx-ingress addon manifests for bare-metal
2018-08-11 21:14:23 +02:00
* Add nginx-ingress manifests for bare-metal
Update Grafana from v5.2.1 to v5.2.2 * https://github.com/grafana/grafana/releases/tag/v5.2.2
2018-07-29 20:12:56 +02:00
* Update Grafana from 5.2.1 to 5.2.2
Update heapster from v1.5.3 to v1.5.4 * https://github.com/kubernetes/heapster/releases/tag/v1.5.4
2018-07-29 20:15:47 +02:00
* Update heapster from v1.5.3 to v1.5.4
Update Grafana from v5.2.1 to v5.2.2 * https://github.com/grafana/grafana/releases/tag/v5.2.2
2018-07-29 20:12:56 +02:00
Support Container Linux Config snippets on bare-metal
2018-07-26 07:44:07 +02:00
## v1.11.1
Update Kubernetes from v1.11.0 to v1.11.1 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1111
2018-07-20 09:36:58 +02:00
* Kubernetes [v1.11.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1111)
Update Prometheus from v2.3.1 to v2.3.2 * https://github.com/prometheus/prometheus/releases/tag/v2.3.2
2018-07-14 23:24:50 +02:00
#### Addons
* Update Prometheus from v2.3.1 to v2.3.2
Fix Kublet version for Fedora Atomic modules * Release v1.11.1 erroneously left Fedora Atomic clusters using the v1.11.0 Kubelet. The rest of the control plane ran v1.11.1 as expected * Update Kubelet from v1.11.0 to v1.11.1 so Fedora Atomic matches Container Linux * Container Linux modules were not affected
2018-07-29 21:13:29 +02:00
#### Errata
* Fedora Atomic modules shipped with Kubelet v1.11.0, instead of v1.11.1. Fixed in [#270](https://github.com/poseidon/typhoon/issues/270).
Update changelog and docs for release
2018-07-04 21:27:26 +02:00
## v1.11.0
Update Kubernetes from v1.10.5 to v1.11.0 * Force apiserver to stop listening on 127.0.0.1:8080 * Remove deprecated Kubelet `--allow-privileged`. Defaults to true. Use `PodSecurityPolicy` if limiting is desired * https://github.com/kubernetes/kubernetes/releases/tag/v1.11.0 * https://github.com/poseidon/terraform-render-bootkube/pull/68
2018-06-28 07:47:35 +02:00
* Kubernetes [v1.11.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1110)
* Force apiserver to stop listening on `127.0.0.1:8080`
Replace kube-dns with CoreDNS * Add system:coredns ClusterRole and binding * Annotate CoreDNS for Prometheus metrics scraping * Remove kube-dns deployment, service, & service account * https://github.com/poseidon/terraform-render-bootkube/pull/71 * https://kubernetes.io/blog/2018/06/27/kubernetes-1.11-release-announcement/
2018-07-02 04:41:57 +02:00
* Replace `kube-dns` with [CoreDNS](https://coredns.io/) ([#261](https://github.com/poseidon/typhoon/pull/261))
* Edit the `coredns` ConfigMap to [customize](https://coredns.io/plugins/)
Update changelog and docs for release
2018-07-04 21:27:26 +02:00
* CoreDNS doesn't use a resizer. For large clusters, scaling may be required.
Update Kubernetes from v1.10.5 to v1.11.0 * Force apiserver to stop listening on 127.0.0.1:8080 * Remove deprecated Kubelet `--allow-privileged`. Defaults to true. Use `PodSecurityPolicy` if limiting is desired * https://github.com/kubernetes/kubernetes/releases/tag/v1.11.0 * https://github.com/poseidon/terraform-render-bootkube/pull/68
2018-06-28 07:47:35 +02:00
Update Fedora Atomic from 27 to 28 on AWS
2018-07-01 02:25:54 +02:00
#### AWS
* Update from Fedora Atomic 27 to 28 ([#258](https://github.com/poseidon/typhoon/pull/258))
Update Fedora Atomic from 27 to 28 on bare-metal
2018-07-04 20:16:04 +02:00
#### Bare-Metal
* Update from Fedora Atomic 27 to 28 ([#263](https://github.com/poseidon/typhoon/pull/263))
Remove deprecated ingress_static_ip and controllers_ipv4_public outputs
2018-07-02 05:47:46 +02:00
#### Google
Promote Typhoon Google Cloud for Container Linux to stable
2018-07-02 07:49:33 +02:00
* Promote Google Cloud to stable
Update Fedora Atomic from 27 to 28 on GCP
2018-07-01 03:12:36 +02:00
* Update from Fedora Atomic 27 to 28 ([#259](https://github.com/poseidon/typhoon/pull/259))
Remove deprecated ingress_static_ip and controllers_ipv4_public outputs
2018-07-02 05:47:46 +02:00
* Remove `ingress_static_ip` module output. Use `ingress_static_ipv4`.
* Remove `controllers_ipv4_public` module output.
Update Grafana from 5.1.4 to 5.2.1 * http://docs.grafana.org/guides/whats-new-in-v5-2/ * https://github.com/grafana/grafana/releases/tag/v5.2.0 * https://github.com/grafana/grafana/releases/tag/v5.2.1
2018-07-02 05:55:34 +02:00
#### Addons
Update Nginx Ingress controller from 0.15.0 to 0.16.2 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.16.2 * https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md
2018-07-03 07:06:22 +02:00
* Update nginx-ingress from 0.15.0 to 0.16.2
Update Grafana from 5.1.4 to 5.2.1 * http://docs.grafana.org/guides/whats-new-in-v5-2/ * https://github.com/grafana/grafana/releases/tag/v5.2.0 * https://github.com/grafana/grafana/releases/tag/v5.2.1
2018-07-02 05:55:34 +02:00
* Update Grafana from 5.1.4 to [5.2.1](http://docs.grafana.org/guides/whats-new-in-v5-2/)
Update heapster from v1.5.2 to v1.5.3
2018-07-02 06:07:52 +02:00
* Update heapster from v1.5.2 to v1.5.3
Update Grafana from 5.1.4 to 5.2.1 * http://docs.grafana.org/guides/whats-new-in-v5-2/ * https://github.com/grafana/grafana/releases/tag/v5.2.0 * https://github.com/grafana/grafana/releases/tag/v5.2.1
2018-07-02 05:55:34 +02:00
Clarify AWS module output names and changes
2018-06-24 00:15:57 +02:00
## v1.10.5
Update Kubernetes from v1.10.4 to v1.10.5 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1105
2018-06-22 07:51:39 +02:00
* Kubernetes [v1.10.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1105)
Update etcd from v3.3.7 to v3.3.8 * https://github.com/coreos/etcd/releases/tag/v3.3.8
2018-06-20 06:55:05 +02:00
* Update etcd from v3.3.6 to v3.3.8 ([#243](https://github.com/poseidon/typhoon/pull/243), [#247](https://github.com/poseidon/typhoon/pull/247))
Fix possible deadlock for provisioning bare-metal clusters * Closes #235
2018-06-15 07:43:01 +02:00
Change kube-apiserver port from 443 to 6443 * Adjust firewall rules, security groups, cloud load balancers, and generated kubeconfig's * Facilitates some future simplifications and cost reductions * Bare-Metal users who exposed kube-apiserver on a WAN via their router or load balancer will need to adjust its configuration. This is uncommon, most apiserver are on LAN and/or behind VPN so no routing infrastructure is configured with the port number
2018-06-19 06:57:58 +02:00
#### AWS
* Switch `kube-apiserver` port from 443 to 6443 ([#248](https://github.com/poseidon/typhoon/pull/248))
Combine NLBs to use one NLB per cluster * Simplify clusters to come with a single NLB * Listen for apiserver traffic on port 6443 and forward to controllers (with healthy apiserver) * Listen for ingress traffic on ports 80/443 and forward to workers (with healthy ingress controller) * Reduce cost of default clusters by 1 NLB ($18.14/month) * Keep using CNAME records to the `ingress_dns_name` NLB and the nginx-ingress addon for Ingress (up to a few million RPS) * Users with heavy traffic (many million RPS) can create their own separate NLB(s) for Ingress and use the new output worker target groups * Fix issue where additional worker pools come with an extraneous network load balancer
2018-06-19 07:56:32 +02:00
* Combine apiserver and ingress NLBs ([#249](https://github.com/poseidon/typhoon/pull/249))
Clarify AWS module output names and changes
2018-06-24 00:15:57 +02:00
* Reduce cost by ~$18/month per cluster. Typhoon AWS clusters now use one network load balancer.
* Ingress addon users may keep using CNAME records to the `ingress_dns_name` module output (few million RPS)
* Ingress users with heavy traffic (many million RPS) should create a separate NLB(s)
* Worker pools no longer include an extraneous load balancer. Remove worker module's `ingress_dns_name` output
Disable AWS detailed monitoring on worker nodes * Basic monitoring (free) is sufficient for casual console browsing * Detailed monitoring (paid) is not leveraged for CloudWatch anyway * Favor Prometheus for cloud-agnostic metrics, aggregation, and alerting
2018-06-22 08:57:38 +02:00
* Disable detailed (paid) monitoring on worker nodes ([#251](https://github.com/poseidon/typhoon/pull/251))
Clarify AWS module output names and changes
2018-06-24 00:15:57 +02:00
* Favor Prometheus for cloud-agnostic metrics, aggregation, and alerting
* Add `worker_target_group_http` and `worker_target_group_https` module outputs to allow custom load balancing
* Add `target_group_http` and `target_group_https` worker module outputs to allow custom load balancing
Change kube-apiserver port from 443 to 6443 * Adjust firewall rules, security groups, cloud load balancers, and generated kubeconfig's * Facilitates some future simplifications and cost reductions * Bare-Metal users who exposed kube-apiserver on a WAN via their router or load balancer will need to adjust its configuration. This is uncommon, most apiserver are on LAN and/or behind VPN so no routing infrastructure is configured with the port number
2018-06-19 06:57:58 +02:00
Fix possible deadlock for provisioning bare-metal clusters * Closes #235
2018-06-15 07:43:01 +02:00
#### Bare-Metal
Change kube-apiserver port from 443 to 6443 * Adjust firewall rules, security groups, cloud load balancers, and generated kubeconfig's * Facilitates some future simplifications and cost reductions * Bare-Metal users who exposed kube-apiserver on a WAN via their router or load balancer will need to adjust its configuration. This is uncommon, most apiserver are on LAN and/or behind VPN so no routing infrastructure is configured with the port number
2018-06-19 06:57:58 +02:00
* Switch `kube-apiserver` port from 443 to 6443 ([#248](https://github.com/poseidon/typhoon/pull/248))
* Users who exposed kube-apiserver on a WAN via their router/load-balancer will need to adjust its configuration (e.g. DNAT 6443). Most apiservers are on a LAN (internal, VPN-only, etc) so if you didn't specially configure network gear for 443, no change is needed. (possible action required)
Fix possible deadlock for provisioning bare-metal clusters * Closes #235
2018-06-15 07:43:01 +02:00
* Fix possible deadlock when provisioning clusters larger than 10 nodes ([#244](https://github.com/poseidon/typhoon/pull/244))
Update etcd from v3.3.6 to v3.3.7
2018-06-15 07:28:11 +02:00
Change kube-apiserver port from 443 to 6443 * Adjust firewall rules, security groups, cloud load balancers, and generated kubeconfig's * Facilitates some future simplifications and cost reductions * Bare-Metal users who exposed kube-apiserver on a WAN via their router or load balancer will need to adjust its configuration. This is uncommon, most apiserver are on LAN and/or behind VPN so no routing infrastructure is configured with the port number
2018-06-19 06:57:58 +02:00
#### DigitalOcean
* Switch `kube-apiserver` port from 443 to 6443 ([#248](https://github.com/poseidon/typhoon/pull/248))
* Update firewall rules and generated kubeconfig's
Use global HTTP/TCP proxy load balancing for Ingress on GCP * Switch Ingress from regional network load balancers to global HTTP/TCP Proxy load balancing * Reduce cost by ~$19/month per cluster. Google bills the first 5 global and regional forwarding rules separately. Typhoon clusters now use 3 global and 0 regional forwarding rules. * Worker pools no longer include an extraneous load balancer. Remove worker module's `ingress_static_ip` output. * Add `ingress_static_ipv4` output variable * Add `worker_instance_group` output to allow custom global load balancing * Deprecate `controllers_ipv4_public` module output * Deprecate `ingress_static_ip` module output. Use `ingress_static_ipv4`
2018-05-07 08:21:53 +02:00
#### Google Cloud
* Use global HTTP and TCP proxy load balancing for Kubernetes Ingress ([#252](https://github.com/poseidon/typhoon/pull/252))
* Switch Ingress from regional network load balancers to global HTTP/TCP Proxy load balancing
* Reduce cost by ~$19/month per cluster. Google bills the first 5 global and regional forwarding rules separately. Typhoon clusters now use 3 global and 0 regional forwarding rules.
* Worker pools no longer include an extraneous load balancer. Remove worker module's `ingress_static_ip` output
Clarify AWS module output names and changes
2018-06-24 00:15:57 +02:00
* Allow using nginx-ingress addon on Fedora Atomic clusters ([#200](https://github.com/poseidon/typhoon/issues/200))
Use global HTTP/TCP proxy load balancing for Ingress on GCP * Switch Ingress from regional network load balancers to global HTTP/TCP Proxy load balancing * Reduce cost by ~$19/month per cluster. Google bills the first 5 global and regional forwarding rules separately. Typhoon clusters now use 3 global and 0 regional forwarding rules. * Worker pools no longer include an extraneous load balancer. Remove worker module's `ingress_static_ip` output. * Add `ingress_static_ipv4` output variable * Add `worker_instance_group` output to allow custom global load balancing * Deprecate `controllers_ipv4_public` module output * Deprecate `ingress_static_ip` module output. Use `ingress_static_ipv4`
2018-05-07 08:21:53 +02:00
* Add `worker_instance_group` module output to allow custom global load balancing
Clarify AWS module output names and changes
2018-06-24 00:15:57 +02:00
* Add `instance_group` worker module output to allow custom global load balancing
* Deprecate `ingress_static_ip` module output. Add `ingress_static_ipv4` module output instead.
Use global HTTP/TCP proxy load balancing for Ingress on GCP * Switch Ingress from regional network load balancers to global HTTP/TCP Proxy load balancing * Reduce cost by ~$19/month per cluster. Google bills the first 5 global and regional forwarding rules separately. Typhoon clusters now use 3 global and 0 regional forwarding rules. * Worker pools no longer include an extraneous load balancer. Remove worker module's `ingress_static_ip` output. * Add `ingress_static_ipv4` output variable * Add `worker_instance_group` output to allow custom global load balancing * Deprecate `controllers_ipv4_public` module output * Deprecate `ingress_static_ip` module output. Use `ingress_static_ipv4`
2018-05-07 08:21:53 +02:00
* Deprecate `controllers_ipv4_public` module output
Update CLUO from v0.6.0 to v0.7.0
2018-06-14 00:05:22 +02:00
#### Addons
* Update CLUO from v0.6.0 to v0.7.0 ([#242](https://github.com/poseidon/typhoon/pull/242))
Drop hostNetwork from nginx-ingress addon * Both flannel and Calico support host port via `portmap` * Allows writing NetworkPolicies that reference ingress pods in `from` or `to`. HostNetwork pods were difficult to write network policy for since they could circumvent the CNI network to communicate with pods on the same node.
2018-06-22 09:46:41 +02:00
* Update Prometheus from v2.3.0 to v2.3.1
* Update Grafana from 5.1.3 to 5.1.4
* Drop `hostNetwork` from nginx-ingress addon
* Both flannel and Calico support host port via `portmap`
* Allows writing NetworkPolicies that reference ingress pods in `from` or `to`. HostNetwork pods were difficult to write network policy for since they could circumvent the CNI network to communicate with pods on the same node.
Update CLUO from v0.6.0 to v0.7.0
2018-06-14 00:05:22 +02:00
Update prometheus from v2.2.1 to v2.3.0
2018-06-09 20:43:10 +02:00
## v1.10.4
Update Kubernetes from v1.10.3 to v1.10.4
2018-06-07 08:23:11 +02:00
* Kubernetes [v1.10.4](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1104)
Update etcd from v3.3.5 to v3.3.6 * https://github.com/coreos/etcd/releases/tag/v3.3.6
2018-06-07 08:18:37 +02:00
* Update etcd from v3.3.5 to v3.3.6
Update Calico from v3.1.2 to v3.1.3 * https://github.com/projectcalico/calico/releases/tag/v3.1.3 * https://github.com/projectcalico/cni-plugin/releases/tag/v3.1.3
2018-05-31 06:31:12 +02:00
* Update Calico from v3.1.2 to v3.1.3
Add Prometheus liveness and readiness probes
2018-05-31 07:33:16 +02:00
#### Addons
Drop hostNetwork from nginx-ingress addon * Both flannel and Calico support host port via `portmap` * Allows writing NetworkPolicies that reference ingress pods in `from` or `to`. HostNetwork pods were difficult to write network policy for since they could circumvent the CNI network to communicate with pods on the same node.
2018-06-22 09:46:41 +02:00
* Update Prometheus from v2.2.1 to v2.3.0
Add Prometheus liveness and readiness probes
2018-05-31 07:33:16 +02:00
* Add Prometheus liveness and readiness probes
Annotate Grafana so Prometheus scrapes metrics
2018-05-31 07:37:47 +02:00
* Annotate Grafana service so Prometheus scrapes metrics
Label namespaces to ease writing Network Policies
2018-06-09 20:44:21 +02:00
* Label namespaces to ease writing Network Policies
Add Prometheus liveness and readiness probes
2018-05-31 07:33:16 +02:00
Update Kubernetes from v1.10.2 to v1.10.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1103 * Update Calico from v3.1.1 to v3.1.2
2018-05-22 05:41:34 +02:00
## v1.10.3
* Kubernetes [v1.10.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1103)
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Add [Flatcar Linux](https://docs.flatcar-linux.org/) (Container Linux derivative) as an option for AWS and bare-metal (thanks @kinvolk folks)
Configure Prometheus to scrape Kubelets directly * Use Kubelet bearer token authn/authz to scrape metrics * Drop RBAC permission from nodes/proxy to nodes/metrics * Stop proxying kubelet scrapes through the apiserver, since this required higher privilege (nodes/proxy) and can add load to the apiserver on large clusters
2018-05-14 08:49:45 +02:00
* Allow bearer token authentication to the Kubelet ([#216](https://github.com/poseidon/typhoon/issues/216))
Allow bearer token authn/authz to the Kubelet * Require Webhook authorization to the Kubelet * Switch apiserver X509 client cert org to systems:masters to grant the apiserver admin and satisfy the authorization requirement. kubectl commands like logs or exec that have the apiserver make requests of a kubelet continue to work as before * https://kubernetes.io/docs/admin/kubelet-authentication-authorization/ * https://github.com/poseidon/typhoon/issues/215
2018-05-14 08:20:42 +02:00
* Require Webhook authorization to the Kubelet
* Switch apiserver X509 client cert org to satisfy new authorization requirement
Rename container_linux_ bare-metal variables * Allow for Container Linux derivatives * Replace container_linux_channel variable with `os_channel` * Replace `container_linux_version` variable with `os_version` * Please change values `stable`, `beta`, or `alpha` to `coreos-stable`, `coreos-beta`, `coreos-alpha` (action required!)
2018-05-17 07:37:37 +02:00
* Require Terraform v0.11.x and drop support for v0.10.x ([migration guide](https://typhoon.psdn.io/topics/maintenance/#terraform-v011x))
* Update etcd from v3.3.4 to v3.3.5 ([#213](https://github.com/poseidon/typhoon/pull/213))
Update Kubernetes from v1.10.2 to v1.10.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1103 * Update Calico from v3.1.1 to v3.1.2
2018-05-22 05:41:34 +02:00
* Update Calico from v3.1.1 to v3.1.2
Update etcd from v3.3.4 to v3.3.5 * https://github.com/coreos/etcd/releases/tag/v3.3.5
2018-05-10 10:01:25 +02:00
Allow preemptible workers on AWS via spot instances * Add `worker_price` to allow worker spot instances. Defaults to empty string for the worker autoscaling group to use regular on-demand instances. * Add `spot_price` to internal `workers` module for spot worker pools * Note: Unlike GCP `preemptible` workers, spot instances require you to pick a bid price.
2018-04-29 22:19:00 +02:00
#### AWS
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Allow Flatcar Linux by setting `os_image` to flatcar-stable (default), flatcar-beta, flatcar-alpha ([#211](https://github.com/poseidon/typhoon/pull/211))
* Replace `os_channel` variable with `os_image` to align naming across clouds
* Please change values stable, beta, or alpha to coreos-stable, coreos-beta, coreos-alpha (**action required!**)
Allow Flatcar Linux os_image on AWS, rename os_channel * Replace os_channel variable with os_image to align naming across clouds. Users who set this option to stable, beta, or alpha should now set os_image to coreos-stable, coreos-beta, or coreos-alpha. * Default os_image to coreos-stable. This continues to use the most recent image from the stable channel as always. * Allow Container Linux derivative Flatcar Linux by setting os_image to `flatcar-stable`, `flatcar-beta`, `flatcar-alpha`
2018-05-09 07:38:05 +02:00
* Allow preemptible workers via spot instances ([#202](https://github.com/poseidon/typhoon/pull/202))
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Add `worker_price` to allow worker spot instances. Default to empty string for the worker autoscaling group to use regular on-demand instances
Allow preemptible workers on AWS via spot instances * Add `worker_price` to allow worker spot instances. Defaults to empty string for the worker autoscaling group to use regular on-demand instances. * Add `spot_price` to internal `workers` module for spot worker pools * Note: Unlike GCP `preemptible` workers, spot instances require you to pick a bid price.
2018-04-29 22:19:00 +02:00
* Add `spot_price` to internal `workers` module for spot [worker pools](https://typhoon.psdn.io/advanced/worker-pools/)
Add bare-metal network_ip_autodetection_method variable for multi-NIC * Allow setting the Calico host IPv4 address autodetection method * Use Calico's default "first-found" method to support single NIC and bonded NIC nodes * Allow methods like `can-reach=IP` or `interface=REGEX` for multi NIC nodes * https://docs.projectcalico.org/v3.1/reference/node/configuration#ip-autodetection-methods
2018-05-15 08:35:16 +02:00
#### Bare-Metal
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Allow Flatcar Linux by setting `os_channel` to flatcar-stable, flatcar-beta, flatcar-alpha ([#220](https://github.com/poseidon/typhoon/pull/220))
Rename container_linux_ bare-metal variables * Allow for Container Linux derivatives * Replace container_linux_channel variable with `os_channel` * Replace `container_linux_version` variable with `os_version` * Please change values `stable`, `beta`, or `alpha` to `coreos-stable`, `coreos-beta`, `coreos-alpha` (action required!)
2018-05-17 07:37:37 +02:00
* Replace `container_linux_channel` variable with `os_channel`
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Please change values stable, beta, or alpha to coreos-stable, coreos-beta, coreos-alpha (**action required!**)
Rename container_linux_ bare-metal variables * Allow for Container Linux derivatives * Replace container_linux_channel variable with `os_channel` * Replace `container_linux_version` variable with `os_version` * Please change values `stable`, `beta`, or `alpha` to `coreos-stable`, `coreos-beta`, `coreos-alpha` (action required!)
2018-05-17 07:37:37 +02:00
* Replace `container_linux_version` variable with `os_version`
Add bare-metal network_ip_autodetection_method variable for multi-NIC * Allow setting the Calico host IPv4 address autodetection method * Use Calico's default "first-found" method to support single NIC and bonded NIC nodes * Allow methods like `can-reach=IP` or `interface=REGEX` for multi NIC nodes * https://docs.projectcalico.org/v3.1/reference/node/configuration#ip-autodetection-methods
2018-05-15 08:35:16 +02:00
* Add `network_ip_autodetection_method` variable for Calico host IPv4 address detection
* Use Calico's default "first-found" to support single NIC and bonded NIC nodes
Allow Flatcar Linux os_channel on bare-metal * Choose the Container Linux derivative Flatcar Linux on bare-metal by setting os_channel to flatcar-stable, flatcar-beta or flatcar-alpha * As with Container Linux from Red Hat, the version (os_version) must correspond to the channel being used * Thank you to @dongsupark from Kinvolk
2018-05-17 08:30:48 +02:00
* Allow [alternative](https://docs.projectcalico.org/v3.1/reference/node/configuration#ip-autodetection-methods) methods for multi NIC nodes, like can-reach=IP or interface=REGEX
Rename container_linux_ bare-metal variables * Allow for Container Linux derivatives * Replace container_linux_channel variable with `os_channel` * Replace `container_linux_version` variable with `os_version` * Please change values `stable`, `beta`, or `alpha` to `coreos-stable`, `coreos-beta`, `coreos-alpha` (action required!)
2018-05-17 07:37:37 +02:00
* Deprecate `container_linux_oem` variable
Add bare-metal network_ip_autodetection_method variable for multi-NIC * Allow setting the Calico host IPv4 address autodetection method * Use Calico's default "first-found" method to support single NIC and bonded NIC nodes * Allow methods like `can-reach=IP` or `interface=REGEX` for multi NIC nodes * https://docs.projectcalico.org/v3.1/reference/node/configuration#ip-autodetection-methods
2018-05-15 08:35:16 +02:00
Update Fedora Atomic from 27 to 28 on DigitalOcean * Fedora Atomic 27 images disappeared from DigitalOcean and forced this early update (there are known bugs)
2018-05-22 05:33:09 +02:00
#### DigitalOcean
* Update Fedora Atomic module to use Fedora Atomic 28 ([#225](https://github.com/poseidon/typhoon/pull/225))
* Fedora Atomic 27 images disappeared from DigitalOcean and forced this early update
Fix Prometheus data dir to /var/lib/prometheus * A data volume (emptyDir) is mounted to /var/lib/prometheus * Users could swap emptyDir for any desired volume if data persistence is desired. Prometheus previously defaulted to keeping its data in ./data relative to /prometheus. Override this behavior to store data in /var/lib/prometheus
2018-05-02 06:56:28 +02:00
#### Addons
* Fix Prometheus data directory location ([#203](https://github.com/poseidon/typhoon/pull/203))
Configure Prometheus to scrape Kubelets directly * Use Kubelet bearer token authn/authz to scrape metrics * Drop RBAC permission from nodes/proxy to nodes/metrics * Stop proxying kubelet scrapes through the apiserver, since this required higher privilege (nodes/proxy) and can add load to the apiserver on large clusters
2018-05-14 08:49:45 +02:00
* Configure Prometheus to scrape Kubelets directly with bearer token auth instead of proxying through the apiserver ([#217](https://github.com/poseidon/typhoon/pull/217))
* Security improvement: Drop RBAC permission from `nodes/proxy` to `nodes/metrics`
* Scale: Remove per-node proxied scrape load from the apiserver
Update Grafana from v5.1.2 to v5.1.3 * https://github.com/grafana/grafana/releases/tag/v5.1.3
2018-05-18 06:35:16 +02:00
* Update Grafana from v5.04 to v5.1.3 ([#208](https://github.com/poseidon/typhoon/pull/208))
Disable default Google Analytics in Grafana addon * Its come to my attention Grafana reports analytics data by default. Typhoon's philosophy requires user permission for data collection so the addon should have this disabled * http://docs.grafana.org/installation/configuration/#analytics
2018-05-10 10:13:54 +02:00
* Disable Grafana Google Analytics by default ([#214](https://github.com/poseidon/typhoon/issues/214))
Update nginx-ingress from 0.14.0 to 0.15.0 * https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.15.0
2018-05-18 06:42:55 +02:00
* Update nginx-ingress from 0.14.0 to 0.15.0
Annotate nginx-ingress addon for Prometheus auto-discovery * Add Google Cloud firewall rule to allow worker to worker access to health and metrics
2018-05-19 22:05:50 +02:00
* Annotate nginx-ingress service so Prometheus auto-discovers and scrapes service endpoints ([#222](https://github.com/poseidon/typhoon/pull/222))
Fix Prometheus data dir to /var/lib/prometheus * A data volume (emptyDir) is mounted to /var/lib/prometheus * Users could swap emptyDir for any desired volume if data persistence is desired. Prometheus previously defaulted to keeping its data in ./data relative to /prometheus. Override this behavior to store data in /var/lib/prometheus
2018-05-02 06:56:28 +02:00
Allow preemptible workers on AWS via spot instances * Add `worker_price` to allow worker spot instances. Defaults to empty string for the worker autoscaling group to use regular on-demand instances. * Add `spot_price` to internal `workers` module for spot worker pools * Note: Unlike GCP `preemptible` workers, spot instances require you to pick a bid price.
2018-04-29 22:19:00 +02:00
## v1.10.2
digital-ocean: Run etcd cluster on-host, across controllers * Run etcd peers with TLS across controller nodes * Deprecate self-hosted-etcd on the Digital Ocean platform * Distribute etcd TLS certificates as part of initial provisioning * Check the status of etcd by running `systemctl status etcd-member`
2017-10-04 09:07:48 +02:00
Update Kubernetes from v1.10.1 to v1.10.2 * https://github.com/kubernetes/kubernetes/releases/tag/v1.10.2
2018-04-28 09:03:29 +02:00
* Kubernetes [v1.10.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1102)
Update Kubernetes from v1.10.2 to v1.10.3 * https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1103 * Update Calico from v3.1.1 to v3.1.2
2018-05-22 05:41:34 +02:00
* [Introduce](https://typhoon.psdn.io/announce/#april-26-2018) Typhoon for Fedora Atomic ([#199](https://github.com/poseidon/typhoon/pull/199))
Update Calico from v3.0.4 to v3.1.1 * https://github.com/projectcalico/calico/releases/tag/v3.1.1 * https://github.com/projectcalico/calico/releases/tag/v3.1.0
2018-04-22 00:13:38 +02:00
* Update Calico from v3.0.4 to v3.1.1 ([#197](https://github.com/poseidon/typhoon/pull/197))
* https://www.projectcalico.org/announcing-calico-v3-1/
* https://github.com/projectcalico/calico/releases/tag/v3.1.0
Update etcd from v3.3.3 to v3.3.4 * https://github.com/coreos/etcd/releases/tag/v3.3.4
2018-04-28 08:57:26 +02:00
* Update etcd from v3.3.3 to v3.3.4
Add changelog notes for release
2018-04-29 21:04:44 +02:00
* Update kube-dns from v1.14.9 to v1.14.10
Update Calico from v3.0.4 to v3.1.1 * https://github.com/projectcalico/calico/releases/tag/v3.1.1 * https://github.com/projectcalico/calico/releases/tag/v3.1.0
2018-04-22 00:13:38 +02:00
Switch GCP network lb to global TCP proxy lb * Allow multi-controller clusters on Google Cloud * GCP regional network load balancers have a long open bug in which requests originating from a backend instance are routed to the instance itself, regardless of whether the health check passes or not. As a result, only the 0th controller node registers. We've recommended just using single master GCP clusters for a while * https://issuetracker.google.com/issues/67366622 * Workaround issue by switching to a GCP TCP Proxy load balancer. TCP proxy lb routes traffic to a backend service (global) of instance group backends. In our case, spread controllers across 3 zones (all regions have 3+ zones) and organize them in 3 zonal unmanaged instance groups that serve as backends. Allows multi-controller cluster creation * GCP network load balancers only allowed legacy HTTP health checks so kubelet 10255 was checked as an approximation of controller health. Replace with TCP apiserver health checks to detect unhealth or unresponsive apiservers. * Drawbacks: GCP provision time increases, tailed logs now timeout (similar tradeoff in AWS), controllers only span 3 zones instead of the exact number in the region * Workaround in Typhoon has been known and posted for 5 months, but there still appears to be no better alternative. Its probably time to support multi-master and accept the downsides
2018-04-15 09:50:43 +02:00
#### Google Cloud
* Add support for multi-controller clusters (i.e. multi-master) ([#54](https://github.com/poseidon/typhoon/issues/54), [#190](https://github.com/poseidon/typhoon/pull/190))
* Switch from Google Cloud network load balancer to a TCP proxy load balancer. Avoid a [bug](https://issuetracker.google.com/issues/67366622) in Google network load balancers that limited clusters to only bootstrapping one controller node.
* Add TCP health check for apiserver pods on controllers. Replace kubelet check approximation.
Update kube-state-metrics from v1.3.0 to v1.3.1 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.3.1
2018-04-16 02:08:58 +02:00
#### Addons
Add changelog notes for release
2018-04-29 21:04:44 +02:00
* Update nginx-ingress from 0.12.0 to 0.14.0
Update kube-state-metrics from v1.3.0 to v1.3.1 * https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.3.1
2018-04-16 02:08:58 +02:00
* Update kube-state-metrics from v1.3.0 to v1.3.1
## v1.10.1
Update Kubernetes from v1.10.0 to v1.10.1 * Use kubernetes-incubator/bootkube v0.12.0
2018-04-13 05:23:35 +02:00
* Kubernetes [v1.10.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1101)
Add etcd metrics, Prometheus scrapes, and Grafana dash * Use etcd v3.3 --listen-metrics-urls to expose only metrics data via http://0.0.0.0:2381 on controllers * Add Prometheus discovery for etcd peers on controller nodes * Temporarily drop two noisy Prometheus alerts
2018-03-29 06:45:24 +02:00
* Enable etcd v3.3 metrics endpoint ([#175](https://github.com/poseidon/typhoon/pull/175))
Fix bare-metal multiple apply/ssh on Terraform v0.11.4+ * Terraform v0.11.4 introduced changes to remote-exec that mean Typhoon bare-metal clusters require multiple runs of terraform apply to ssh and bootstrap. * Bare-metal installs PXE boot a live instance to install to disk and then reboot from disk as controllers/workers. Terraform remote-exec has no way to "know" to wait until the reboot has occurred to kickoff Kubernetes bootstrap. Previously Typhoon created a "debug" user during this install phase to allow an admin to SSH, but remote-exec would hang, trying to connect as user "core". Terraform v0.11.4 changes this behavior so remote-exec fails and a user must re-run terraform apply until succeeding. * A new way to "trick" remote-exec into waiting for the reboot into the disk install is to run SSH on a non-standard port during the disk install. This retains the ability for an admin to SSH during install (most distros don't have this) and fixes the issue so only a single run of terraform apply is needed. * https://github.com/hashicorp/terraform/pull/17359#issuecomment-376415464
2018-04-05 06:38:03 +02:00
* Use `k8s.gcr.io` instead of `gcr.io/google_containers` ([#180](https://github.com/poseidon/typhoon/pull/180))
Use k8s.gcr.io instead of gcr.io/google_containers * Kubernetes recommends using the alias to fetch images from the nearest GCR regional mirror, to abstract the use of GCR, and to drop names containing 'google' * https://groups.google.com/forum/#!msg/kubernetes-dev/ytjk_rNrTa0/3EFUHvovCAAJ
2018-04-08 21:16:29 +02:00
* Kubernetes [recommends](https://groups.google.com/forum/#!msg/kubernetes-dev/ytjk_rNrTa0/3EFUHvovCAAJ) using the alias to pull from the nearest regional mirror and to abstract the backing container registry
Update etcd from v3.3.2 to v3.3.3 * https://github.com/coreos/etcd/releases/tag/v3.3.3
2018-04-05 05:32:24 +02:00
* Update etcd from v3.3.2 to v3.3.3
Add changelog notes for release
2018-04-29 21:04:44 +02:00
* Update kube-dns from v1.14.8 to v1.14.9
Update Kubernetes from v1.10.0 to v1.10.1 * Use kubernetes-incubator/bootkube v0.12.0
2018-04-13 05:23:35 +02:00
* Use kubernetes-incubator/bootkube v0.12.0
Add etcd metrics, Prometheus scrapes, and Grafana dash * Use etcd v3.3 --listen-metrics-urls to expose only metrics data via http://0.0.0.0:2381 on controllers * Add Prometheus discovery for etcd peers on controller nodes * Temporarily drop two noisy Prometheus alerts
2018-03-29 06:45:24 +02:00
Fix bare-metal multiple apply/ssh on Terraform v0.11.4+ * Terraform v0.11.4 introduced changes to remote-exec that mean Typhoon bare-metal clusters require multiple runs of terraform apply to ssh and bootstrap. * Bare-metal installs PXE boot a live instance to install to disk and then reboot from disk as controllers/workers. Terraform remote-exec has no way to "know" to wait until the reboot has occurred to kickoff Kubernetes bootstrap. Previously Typhoon created a "debug" user during this install phase to allow an admin to SSH, but remote-exec would hang, trying to connect as user "core". Terraform v0.11.4 changes this behavior so remote-exec fails and a user must re-run terraform apply until succeeding. * A new way to "trick" remote-exec into waiting for the reboot into the disk install is to run SSH on a non-standard port during the disk install. This retains the ability for an admin to SSH during install (most distros don't have this) and fixes the issue so only a single run of terraform apply is needed. * https://github.com/hashicorp/terraform/pull/17359#issuecomment-376415464
2018-04-05 06:38:03 +02:00
#### Bare-Metal
* Fix need for multiple `terraform apply` runs to create a cluster with Terraform v0.11.4 ([#181](https://github.com/poseidon/typhoon/pull/181))
* To SSH during a disk install for debugging, SSH as user "core" with port 2222
* Remove the old trick of using a user "debug" during disk install
Refactor GCP to remove controller internal module * Remove the controller internal module to align with other platforms and since its not a supported use case
2018-04-12 08:19:35 +02:00
#### Google Cloud
* Refactor out the `controller` internal module
Add etcd metrics, Prometheus scrapes, and Grafana dash * Use etcd v3.3 --listen-metrics-urls to expose only metrics data via http://0.0.0.0:2381 on controllers * Add Prometheus discovery for etcd peers on controller nodes * Temporarily drop two noisy Prometheus alerts
2018-03-29 06:45:24 +02:00
#### Addons
* Add Prometheus discovery for etcd peers on controller nodes ([#175](https://github.com/poseidon/typhoon/pull/175))
* Scrape etcd v3.3 `--listen-metrics-urls` for metrics
* Enable etcd alerts and populate the etcd Grafana dashboard
Update kube-state-metrics from v1.2.0 to v1.3.0 * https://github.com/kubernetes/kube-state-metrics/pull/412 * https://github.com/kubernetes/kube-state-metrics/pull/413
2018-04-05 06:04:13 +02:00
* Update kube-state-metrics from v1.2.0 to v1.3.0
Add etcd metrics, Prometheus scrapes, and Grafana dash * Use etcd v3.3 --listen-metrics-urls to expose only metrics data via http://0.0.0.0:2381 on controllers * Add Prometheus discovery for etcd peers on controller nodes * Temporarily drop two noisy Prometheus alerts
2018-03-29 06:45:24 +02:00
## v1.10.0
Update CHANGES.md with Kubernetes link
2018-03-31 08:12:38 +02:00
* Kubernetes [v1.10.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1100)
Remove unmaintained pxe-worker internal module
2018-03-26 06:56:55 +02:00
* Remove unused, unmaintained `pxe-worker` internal module
Add disk_type variable for EBS volume type on AWS * Change EBS volume type from `standard` ("prior generation) to `gp2`. Prometheus alerts are tuned for SSDs * Other platforms have fast enough disks by default
2018-03-29 09:24:07 +02:00
#### AWS
* Add `disk_type` optional variable for setting the EBS volume type ([#176](https://github.com/poseidon/typhoon/pull/176))
* Change default type from `standard` to `gp2`. Prometheus etcd alerts are tuned for fast disks.
Remove optional variable networking on Digital Ocean * Calico isn't viable on Digital Ocean because their firewalls do not support IP-IP protocol. Its not viable to run a cluster without firewalls just to use Calico. * Remove the caveat note. Don't allow users to shoot themselves in the foot
2018-03-26 06:48:08 +02:00
#### Digital Ocean
Ensure etcd secrets are only distributed to controller hosts * Previously, etcd secrets were erroneously distributed to worker nodes (permissions 500, ownership etc:etcd).
2018-03-26 07:32:09 +02:00
* Ensure etcd secrets are only distributed to controller hosts, not workers.
Add disk_type variable for EBS volume type on AWS * Change EBS volume type from `standard` ("prior generation) to `gp2`. Prometheus alerts are tuned for SSDs * Other platforms have fast enough disks by default
2018-03-29 09:24:07 +02:00
* Remove `networking` optional variable. Only flannel works on Digital Ocean.
Remove optional variable networking on Digital Ocean * Calico isn't viable on Digital Ocean because their firewalls do not support IP-IP protocol. Its not viable to run a cluster without firewalls just to use Calico. * Remove the caveat note. Don't allow users to shoot themselves in the foot
2018-03-26 06:48:08 +02:00
Add disk_size variable on Google Cloud
2018-03-26 07:04:14 +02:00
#### Google Cloud
Add disk_type variable for EBS volume type on AWS * Change EBS volume type from `standard` ("prior generation) to `gp2`. Prometheus alerts are tuned for SSDs * Other platforms have fast enough disks by default
2018-03-29 09:24:07 +02:00
* Add `disk_size` optional variable for setting instance disk size in GB
* Add `controller_type` optional variable for setting machine type for controllers
* Add `worker_type` optional variable for setting machine type for workers
* Remove `machine_type` optional variable. Use `controller_type` and `worker_type`.
Add disk_size variable on Google Cloud
2018-03-26 07:04:14 +02:00
addons: Update from Grafana v4.6.3 to v5.0.4 This reverts commit c59a9c66b1764cbd95df32f74af1dd66a3008450.
2018-03-29 04:12:39 +02:00
#### Addons
* Update Grafana from v4.6.3 to v5.0.4 ([#153](https://github.com/poseidon/typhoon/pull/153), [#174](https://github.com/poseidon/typhoon/pull/174))
* Restrict dashboard organization role to Viewer
Add v1.9.6 heading to CHANGES.md
2018-03-23 05:56:29 +01:00
## v1.9.6
Update Kubernetes from v1.9.5 to v1.9.6
2018-03-22 04:29:52 +01:00
* Kubernetes [v1.9.6](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v196)
* Update Calico from v3.0.3 to v3.0.4
addons: Update heapster from v1.5.1 to v1.5.2 * https://github.com/kubernetes/heapster/releases/tag/v1.5.2
2018-03-22 04:32:01 +01:00
#### Addons
* Update heapster from v1.5.1 to v1.5.2
Update nginx-ingress from 0.11.0 to 0.12.0
2018-03-20 07:15:57 +01:00
## v1.9.5
Update Kubernetes from v1.9.4 to v1.9.5
2018-03-19 01:50:14 +01:00
* Kubernetes [v1.9.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v195)
* Fix `subPath` volume mounts regression ([kubernetes#61076](https://github.com/kubernetes/kubernetes/issues/61076))
Improve changelog with migration links
2018-03-19 07:52:59 +01:00
* Introduce [Container Linux Config snippets](https://typhoon.psdn.io/advanced/customization/#container-linux) on cloud platforms ([#145](https://github.com/poseidon/typhoon/pull/145))
* Validate and additively merge custom Container Linux Configs during `terraform plan`
* Define files, systemd units, dropins, networkd configs, mounts, users, and more
* Require updating `terraform-provider-ct` plugin from v0.2.0 to v0.2.1
Mention controllers node label in changelog
2018-03-19 08:14:47 +01:00
* Add `node-role.kubernetes.io/controller="true"` node label to controllers ([#160](https://github.com/poseidon/typhoon/pull/160))
Improve changelog with migration links
2018-03-19 07:52:59 +01:00
#### AWS
Update links to Matchbox, terraform-provider-ct, etc. * Matchbox, terraform-provider-matchbox, and terraform-provider-ct have moved to the poseidon Github organization
2019-05-04 19:46:07 +02:00
* [Require](https://typhoon.psdn.io/topics/maintenance/#terraform-provider-ct-v021) updating `terraform-provider-ct` plugin from v0.2.0 to [v0.2.1](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.2.1) (action required!)
Improve changelog with migration links
2018-03-19 07:52:59 +01:00
#### Digital Ocean
Update links to Matchbox, terraform-provider-ct, etc. * Matchbox, terraform-provider-matchbox, and terraform-provider-ct have moved to the poseidon Github organization
2019-05-04 19:46:07 +02:00
* [Require](https://typhoon.psdn.io/topics/maintenance/#terraform-provider-ct-v021) updating `terraform-provider-ct` plugin from v0.2.0 to [v0.2.1](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.2.1) (action required!)
Improve changelog with migration links
2018-03-19 07:52:59 +01:00
#### Google Cloud
Update links to Matchbox, terraform-provider-ct, etc. * Matchbox, terraform-provider-matchbox, and terraform-provider-ct have moved to the poseidon Github organization
2019-05-04 19:46:07 +02:00
* [Require](https://typhoon.psdn.io/topics/maintenance/#terraform-provider-ct-v021) updating `terraform-provider-ct` plugin from v0.2.0 to [v0.2.1](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.2.1) (action required!)
Set default Google Cloud os_image to coreos-stable
2018-03-19 08:06:37 +01:00
* Relax `os_image` to optional. Default to "coreos-stable".
Improve changelog with migration links
2018-03-19 07:52:59 +01:00
Update Prometheus from 2.2.0 to 2.2.1
2018-03-18 23:55:42 +01:00
#### Addons
Update nginx-ingress from 0.11.0 to 0.12.0
2018-03-20 07:15:57 +01:00
* Update nginx-ingress from 0.11.0 to 0.12.0
Update Prometheus from 2.2.0 to 2.2.1
2018-03-18 23:55:42 +01:00
* Update Prometheus from 2.2.0 to 2.2.1
Improve changelog, README, and index page
2018-03-13 04:55:35 +01:00
## v1.9.4
Update Kubernetes from v1.9.3 to v1.9.4
2018-03-11 21:15:35 +01:00
* Kubernetes [v1.9.4](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v194)
Add clarifying links to CHANGES
2018-03-13 05:19:15 +01:00
* Secret, configMap, downward API, and projected volumes now read-only (breaking, [kubernetes#58720](https://github.com/kubernetes/kubernetes/pull/58720))
Add links to upstream regressions
2018-03-15 02:54:22 +01:00
* Regressed `subPath` volume mounts (regression, [kubernetes#61076](https://github.com/kubernetes/kubernetes/issues/61076))
Add clarifying links to CHANGES
2018-03-13 05:19:15 +01:00
* Mitigated `subPath` [CVE-2017-1002101](https://github.com/kubernetes/kubernetes/issues/60813)
Improve changelog, README, and index page
2018-03-13 04:55:35 +01:00
* Introduce [worker pools](https://typhoon.psdn.io/advanced/worker-pools/) for AWS and Google Cloud for joining heterogeneous workers to existing clusters.
Add details and links to the changelog
2018-03-12 01:05:55 +01:00
* Use new Network Load Balancers and cross zone load balancing on AWS
Update Kubernetes from v1.9.3 to v1.9.4
2018-03-11 21:15:35 +01:00
* Allow flexvolume plugins to be used on any Typhoon cluster (not just bare-metal)
Update etcd from v3.3.1 to v3.3.2 * https://github.com/coreos/etcd/releases/tag/v3.3.2
2018-03-09 09:43:15 +01:00
* Upgrade etcd from v3.2.15 to v3.3.2
Update Calico from v3.0.2 to v3.0.3 * https://github.com/projectcalico/calico/releases/tag/v3.0.3
2018-02-25 04:16:20 +01:00
* Update Calico from v3.0.2 to v3.0.3
Update Kubernetes from v1.10.0 to v1.10.1 * Use kubernetes-incubator/bootkube v0.12.0
2018-04-13 05:23:35 +02:00
* Use kubernetes-incubator/bootkube v0.11.0
Update links to Matchbox, terraform-provider-ct, etc. * Matchbox, terraform-provider-matchbox, and terraform-provider-ct have moved to the poseidon Github organization
2019-05-04 19:46:07 +02:00
* [Recommend](https://typhoon.psdn.io/topics/maintenance/#terraform-provider-ct-v021) updating `terraform-provider-ct` plugin from v0.2.0 to [v0.2.1](https://github.com/poseidon/terraform-provider-ct/releases/tag/v0.2.1) (action recommended)
Upgrade etcd from v3.2.15 to v3.3.1
2018-02-16 04:29:17 +01:00
addons: Update nginx-ingress from 0.10.2 to 0.11.0
2018-02-22 08:45:50 +01:00
#### AWS
Promote AWS platform from beta to stable
2018-03-13 05:15:53 +01:00
* Promote AWS platform to stable
Add details and links to the changelog
2018-03-12 01:05:55 +01:00
* Allow groups of workers to be defined and joined to a cluster (i.e. worker pools) ([#150](https://github.com/poseidon/typhoon/pull/150))
* Replace the apiserver elastic load balancer with a network load balancer ([#136](https://github.com/poseidon/typhoon/pull/136))
* Replace the Ingress elastic load balancer with a network load balancer ([#141](https://github.com/poseidon/typhoon/pull/141))
Improve links in tutorials and changelog notes
2018-02-26 21:55:32 +01:00
* AWS [NLBs](https://aws.amazon.com/blogs/aws/new-network-load-balancer-effortless-scaling-to-millions-of-requests-per-second/) can handle millions of RPS with high throughput and low latency.
Add details and links to the changelog
2018-03-12 01:05:55 +01:00
* Require `terraform-provider-aws` 1.7.0 or higher
Improve changelog, README, and index page
2018-03-13 04:55:35 +01:00
* Enable NLB [cross-zone](https://aws.amazon.com/about-aws/whats-new/2018/02/network-load-balancer-now-supports-cross-zone-load-balancing/) load balancing ([#159](https://github.com/poseidon/typhoon/pull/159))
* Requests are automatically evenly distributed to targets regardless of AZ
Add details and links to the changelog
2018-03-12 01:05:55 +01:00
* Require `terraform-provider-aws` 1.11.0 or higher
Add kubelet --volume-plugin-dir flag * Set Kubelet search path for flexvolume plugins to /var/lib/kubelet/volumeplugins * Add support for flexvolume plugins on AWS, GCE, and DO * See 9548572d982 which added flexvolume support for bare-metal
2018-02-23 07:00:51 +01:00
* Add kubelet `--volume-plugin-dir` flag to allow flexvolume plugins ([#142](https://github.com/poseidon/typhoon/pull/142))
Add ignore_changes for AWS worker image_id
2018-03-10 22:13:48 +01:00
* Fix controller and worker launch configs to ignore AMI changes ([#126](https://github.com/poseidon/typhoon/pull/126), [#158](https://github.com/poseidon/typhoon/pull/158))
Add kubelet --volume-plugin-dir flag * Set Kubelet search path for flexvolume plugins to /var/lib/kubelet/volumeplugins * Add support for flexvolume plugins on AWS, GCE, and DO * See 9548572d982 which added flexvolume support for bare-metal
2018-02-23 07:00:51 +01:00
#### Digital Ocean
* Add kubelet `--volume-plugin-dir` flag to allow flexvolume plugins ([#142](https://github.com/poseidon/typhoon/pull/142))
Pass Digital Ocean ssh_fingerprints as a list * Fix digital-ocean module to pass ssh_fingerprints as a list since the module accepts a list
2018-02-25 01:22:57 +01:00
* Fix to pass `ssh_fingerprints` as a list to droplets ([#143](https://github.com/poseidon/typhoon/pull/143))
Add kubelet --volume-plugin-dir flag * Set Kubelet search path for flexvolume plugins to /var/lib/kubelet/volumeplugins * Add support for flexvolume plugins on AWS, GCE, and DO * See 9548572d982 which added flexvolume support for bare-metal
2018-02-23 07:00:51 +01:00
#### Google Cloud
Add support for worker pools on AWS * Allow groups of workers to be defined and joined to a cluster (i.e. worker pools) * Move worker resources into a Terraform submodule * Output variables needed for passing to worker pools * Add usage docs for AWS worker pools (advanced)
2018-02-27 07:16:34 +01:00
* Allow groups of workers to be defined and joined to a cluster (i.e. worker pools) ([#148](https://github.com/poseidon/typhoon/pull/148))
Add kubelet --volume-plugin-dir flag * Set Kubelet search path for flexvolume plugins to /var/lib/kubelet/volumeplugins * Add support for flexvolume plugins on AWS, GCE, and DO * See 9548572d982 which added flexvolume support for bare-metal
2018-02-23 07:00:51 +01:00
* Add kubelet `--volume-plugin-dir` flag to allow flexvolume plugins ([#142](https://github.com/poseidon/typhoon/pull/142))
Simplify CLC kubeconfig templating on AWS and GCP * Template terraform-render-bootkube's multi-line kubeconfig output using the right indentation * Add `kubeconfig` variable to google-cloud controllers and workers Terraform submodules * Remove `kubeconfig_*` variables from google-cloud controllers and workers Terraform submodules
2018-02-26 21:17:42 +01:00
* Add `kubeconfig` variable to `controllers` and `workers` submodules ([#147](https://github.com/poseidon/typhoon/pull/147))
* Remove `kubeconfig_*` variables from `controllers` and `workers` submodules ([#147](https://github.com/poseidon/typhoon/pull/147))
Allow Google accelerators (i.e. GPUs) on workers
2018-03-03 02:26:51 +01:00
* Allow initial experimentation with accelerators (i.e. GPUs) on workers ([#161](https://github.com/poseidon/typhoon/pull/161)) (unofficial)
* Require `terraform-provider-google` v1.6.0
addons: Update Heapster from v1.5.0 to v1.5.1 * Switch to k8s.gcr.io vanity image name * Add service account, Role, and ClusterRole for heapster
2018-02-11 19:45:39 +01:00
List addons below platforms in CHANGES
2018-02-23 07:33:13 +01:00
#### Addons
Update CHANGES.md changelog with monitoring updates
2018-03-03 06:59:19 +01:00
* Update Prometheus from 2.1.0 to 2.2.0 ([#153](https://github.com/poseidon/typhoon/pull/153))
Add details and links to the changelog
2018-03-12 01:05:55 +01:00
* Scrape Prometheus itself to enable alerts about Prometheus itself
* Adjust KubeletDown rule to fire when 10% of kubelets are down
List addons below platforms in CHANGES
2018-02-23 07:33:13 +01:00
* Update heapster from v1.5.0 to v1.5.1 ([#131](https://github.com/poseidon/typhoon/pull/131))
* Use separate service account
* Update nginx-ingress from 0.10.2 to 0.11.0
Update CHANGELOG.md for v1.9.3
2018-02-11 19:59:16 +01:00
## v1.9.3
Update Kubernetes from v1.9.2 to v1.9.3 * Add flannel service account and limited RBAC cluster role * Change DaemonSets to tolerate NoSchedule and NoExecute taints * Remove deprecated apiserver --etcd-quorum-read flag * Update Calico from v3.0.1 to v3.0.2 * Add Calico GlobalNetworkSet CRD * https://github.com/poseidon/terraform-render-bootkube/pull/44
2018-02-10 21:49:34 +01:00
* Kubernetes [v1.9.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v193)
Update CHANGELOG.md for v1.9.3
2018-02-11 19:59:16 +01:00
* Network improvements and fixes ([#104](https://github.com/poseidon/typhoon/pull/104))
Update Kubernetes from v1.9.2 to v1.9.3 * Add flannel service account and limited RBAC cluster role * Change DaemonSets to tolerate NoSchedule and NoExecute taints * Remove deprecated apiserver --etcd-quorum-read flag * Update Calico from v3.0.1 to v3.0.2 * Add Calico GlobalNetworkSet CRD * https://github.com/poseidon/terraform-render-bootkube/pull/44
2018-02-10 21:49:34 +01:00
* Switch from Calico v2.6.6 to v3.0.2
* Add Calico GlobalNetworkSet CRD
Update flannel from v0.9.0 to v0.10.0 * https://github.com/coreos/flannel/releases/tag/v0.10.0
2018-01-29 08:09:21 +01:00
* Update flannel from v0.9.0 to v0.10.0
Update Kubernetes from v1.9.2 to v1.9.3 * Add flannel service account and limited RBAC cluster role * Change DaemonSets to tolerate NoSchedule and NoExecute taints * Remove deprecated apiserver --etcd-quorum-read flag * Update Calico from v3.0.1 to v3.0.2 * Add Calico GlobalNetworkSet CRD * https://github.com/poseidon/terraform-render-bootkube/pull/44
2018-02-10 21:49:34 +01:00
* Use separate service account for flannel
Update flannel from v0.9.0 to v0.10.0 * https://github.com/coreos/flannel/releases/tag/v0.10.0
2018-01-29 08:09:21 +01:00
* Update etcd from v3.2.14 to v3.2.15
Update etcd from 3.2.14 to 3.2.15 * https://github.com/coreos/etcd/releases/tag/v3.2.15
2018-01-24 08:50:04 +01:00
List addons below platforms in CHANGES
2018-02-23 07:33:13 +01:00
#### Digital Ocean
* Use new Droplet [types](https://developers.digitalocean.com/documentation/changelog/api-v2/new-size-slugs-for-droplet-plan-changes/) which offer more CPU/memory, at lower cost. ([#105](https://github.com/poseidon/typhoon/pull/105))
* A small Digital Ocean cluster costs less than $25 a month!
Update changelog with recent addon improvements
2018-01-28 10:24:27 +01:00
#### Addons
Update CHANGELOG.md for v1.9.3
2018-02-11 19:59:16 +01:00
* Update Prometheus from v2.0.0 to v2.1.0 ([#113](https://github.com/poseidon/typhoon/pull/113))
Update changelog with recent addon improvements
2018-01-28 10:24:27 +01:00
* Improve alerting rules
* Relabel discovered kubelet, endpoint, service, and apiserver scrapes
* Use separate service accounts
* Update node-exporter and kube-state-metrics
Update CHANGELOG.md for v1.9.3
2018-02-11 19:59:16 +01:00
* Include Grafana dashboards for Kubernetes admins ([#113](https://github.com/poseidon/typhoon/pull/113))
Update changelog with recent addon improvements
2018-01-28 10:24:27 +01:00
* Add grafana-watcher to load bundled upstream dashboards
* Update nginx-ingress from 0.9.0 to 0.10.2
addons: Switch to apps/v1 workload APIs * Deployments now belong to the apps/v1 API group * DaemonSets now belong to the apps/v1 API group * RBAC types now belong to the rbac.authorization.k8s.io/v1 API group
2018-02-11 08:51:55 +01:00
* Update CLUO from v0.5.0 to v0.6.0
Update CHANGELOG.md for v1.9.3
2018-02-11 19:59:16 +01:00
* Switch manifests to use `apps/v1` Deployments and Daemonsets ([#120](https://github.com/poseidon/typhoon/pull/120))
addons: Remove Kubernetes Dashboard manifests and docs * Stop maintaining Kubernetes Dashboard manifests. Dashboard takes an unusual approch to security and is often a security weak point. * Recommendation: Use `kubectl` and avoid using the dashboard. If you must use the dashboard, explore hardening and consider using an authenticating proxy rather than the dashboard's auth features
2018-02-11 19:19:09 +01:00
* Remove Kubernetes Dashboard manifests ([#121](https://github.com/poseidon/typhoon/pull/121))
Update changelog with recent addon improvements
2018-01-28 10:24:27 +01:00
Update Kubernetes from v1.9.1 to v1.9.2
2018-01-19 17:40:09 +01:00
## v1.9.2
* Kubernetes [v1.9.2](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v192)
Add Terraform v0.11.x support and migration docs * Add explicit "providers" section to modules for Terraform v0.11.x * Retain support for Terraform v0.10.4+ * Add migration guide from Terraform v0.10.x to v0.11.x for those managing existing clusters (action required!)
2018-01-12 15:56:08 +01:00
* Add Terraform v0.11.x support
* Add explicit "providers" section to modules for Terraform v0.11.x
* Retain support for Terraform v0.10.4+
Improve links in tutorials and changelog notes
2018-02-26 21:55:32 +01:00
* Add [migration guide](https://typhoon.psdn.io/topics/maintenance/#terraform-v011x) from Terraform v0.10.x to v0.11.x (**action required!**)
Update etcd from 3.2.13 to 3.2.14 * https://github.com/coreos/etcd/releases/tag/v3.2.14
2018-01-12 16:19:56 +01:00
* Update etcd from 3.2.13 to 3.2.14
Update bootkube and terraform-render-bootkube to v0.10.0
2018-01-20 08:10:45 +01:00
* Update calico from 2.6.5 to 2.6.6
Update kube-dns and use separate service account * Update kube-dns from v1.14.7 to v1.14.8 * Use a separate kube-dns service account * https://github.com/kubernetes/kubernetes/pull/57918
2018-01-12 17:12:18 +01:00
* Update kube-dns from v1.14.7 to v1.14.8
* Use separate service account for kube-dns
Update bootkube and terraform-render-bootkube to v0.10.0
2018-01-20 08:10:45 +01:00
* Use kubernetes-incubator/bootkube v0.10.0
Update etcd from 3.2.13 to 3.2.14 * https://github.com/coreos/etcd/releases/tag/v3.2.14
2018-01-12 16:19:56 +01:00
Create separate bare-metal container-linux-install profiles * Create separate container-linux-install profiles (and cached-container-linux-install) for each node in a cluster * Fix contention bug on bare-metal during `terraform apply`. With only a global install profile, terraform would create (or retain) the profile for each cluster and try to delete it for each cluster being deleted. As a result, in some cases apply had to be run multiple times before terraform's repr of constraints was satisfied (profile deleted and recreated) * Allow Container Linux install properties to vary between clusters, such as using a different Container Linux channel or version for different clusters
2018-01-14 21:36:40 +01:00
#### Bare-Metal
* Use per-node Container Linux install profiles ([#97](https://github.com/poseidon/typhoon/pull/97))
* Allow Container Linux channel/version to be chosen per-cluster
* Fix issue where cluster deletion could require `terraform apply` multiple times
Relax digitalocean provider version constraints * Relax fixed 0.1.2 version constraint to "~> 0.1.2", which allows 0.1.3, 0.1.4, etc, but would not allow 0.2.0
2018-01-16 05:57:55 +01:00
#### Digital Ocean
* Relax `digitalocean` provider version constraint
Add missing changelog entry for Digital Ocean fix
2018-01-20 16:52:40 +01:00
* Fix bug with `terraform plan` always showing a firewall diff to be applied ([#3](https://github.com/poseidon/typhoon/issues/3))
Relax digitalocean provider version constraints * Relax fixed 0.1.2 version constraint to "~> 0.1.2", which allows 0.1.3, 0.1.4, etc, but would not allow 0.2.0
2018-01-16 05:57:55 +01:00
List addons below platforms in CHANGES
2018-02-23 07:33:13 +01:00
#### Addons
* Update CLUO to v0.5.0 to fix compatibility with Kubernetes 1.9 (**important**)
* Earlier versions can't roll out Container Linux updates on Kubernetes 1.9 nodes ([cluo#163](https://github.com/coreos/container-linux-update-operator/issues/163))
* Update kube-state-metrics from v1.1.0 to v1.2.0
* Fix RBAC cluster role for kube-state-metrics
Update etcd from 3.2.13 to 3.2.14 * https://github.com/coreos/etcd/releases/tag/v3.2.14
2018-01-12 16:19:56 +01:00
## v1.9.1
Update Kubernetes from v1.8.6 to v1.9.1
2017-12-21 23:06:38 +01:00
* Kubernetes [v1.9.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md#v191)
Update CHANGELOG.md for v1.9.1
2018-01-09 16:03:04 +01:00
* Update kube-dns from 1.14.5 to v1.14.7
* Update etcd from 3.2.0 to 3.2.13
* Update Calico from v2.6.4 to v2.6.5
* Enable portmap to fix hostPort with Calico
Update kube-dns and use separate service account * Update kube-dns from v1.14.7 to v1.14.8 * Use a separate kube-dns service account * https://github.com/kubernetes/kubernetes/pull/57918
2018-01-12 17:12:18 +01:00
* Use separate service account for controller-manager
Update Kubernetes from v1.8.6 to v1.9.1
2017-12-21 23:06:38 +01:00
Update CHANGELOG.md for v1.8.6
2017-12-22 22:00:18 +01:00
## v1.8.6
Update Kubernetes from v1.8.5 to v1.8.6
2017-12-21 19:30:13 +01:00
* Kubernetes [v1.8.6](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.8.md#v186)
Update CHANGELOG.md for v1.9.1
2018-01-09 16:03:04 +01:00
* Update Calico from v2.6.3 to v2.6.4
Update Kubernetes from v1.8.5 to v1.8.6
2017-12-21 19:30:13 +01:00
Update CHANGELOG.md for v1.8.5
2017-12-15 10:52:51 +01:00
## v1.8.5
Add Kubernetes Dashboard warning and improve changelog
2017-12-10 07:38:27 +01:00
* Kubernetes [v1.8.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.8.md#v185)
* Recommend Container Linux [images](https://coreos.com/releases/) with Docker 17.09
Recommend Container Linux images with Docker 17.09 * Container Linux stable and beta now provide Docker 17.09 (instead of 1.12). Recommend images which provide 17.09. * Older clusters (with CLUO addon) auto-update node's Container Linux version and will begin using Docker 17.09.
2017-12-10 07:02:45 +01:00
* Container Linux stable, beta, and alpha now provide Docker 17.09 (instead
Update CHANGELOG.md for v1.8.5
2017-12-15 10:52:51 +01:00
of 1.12)
* Older clusters (with CLUO addon) auto-update Container Linux version to begin using Docker 17.09
Add Kubernetes Dashboard warning and improve changelog
2017-12-10 07:38:27 +01:00
* Fix race where `etcd-member.service` could fail to resolve peers ([#69](https://github.com/poseidon/typhoon/pull/69))
Update CHANGELOG.md for v1.8.5
2017-12-15 10:52:51 +01:00
* Add optional `cluster_domain_suffix` variable (#74)
Update bootkube and terraform-render-bootkube to v0.9.1
2017-12-15 10:45:02 +01:00
* Use kubernetes-incubator/bootkube v0.9.1
Add Kubernetes Dashboard warning and improve changelog
2017-12-10 07:38:27 +01:00
#### Bare-Metal
* Add kubelet `--volume-plugin-dir` flag to allow flexvolume providers ([#61](https://github.com/poseidon/typhoon/pull/61))
#### Addons
Update CHANGELOG.md for v1.8.5
2017-12-15 10:52:51 +01:00
* Discourage deploying the Kubernetes Dashboard (security)
Update Kubernetes from v1.8.4 to v1.8.5
2017-12-08 17:56:53 +01:00
Update bootkube and terraform-render-bootkube to v0.9.0
2017-12-02 07:27:48 +01:00
## v1.8.4
Update Kubernetes from v1.8.3 to v1.8.4
2017-11-29 06:52:11 +01:00
* Kubernetes v1.8.4
* Calico related bug fixes
* Update Calico from v2.6.1 to v2.6.3
* Update flannel from v0.9.0 to v0.9.1
Update bootkube and terraform-render-bootkube to v0.9.0
2017-12-02 07:27:48 +01:00
* Service accounts for kube-proxy and pod-checkpointer
* Use kubernetes-incubator/bootkube v0.9.0
Update Kubernetes from v1.8.3 to v1.8.4
2017-11-29 06:52:11 +01:00
addons: Add better alerting rules to Prometheus manifests * Adapt the coreos/prometheus-operator alerting rules for Typhoon, https://github.com/coreos/prometheus-operator/tree/master/contrib/kube-prometheus/manifests * Add controller manager and scheduler shim services to let prometheus discover them via service endpoints * Fix several alert rules to use service endpoint discovery * A few rules still don't do much, but they default to green
2017-11-08 10:35:56 +01:00
## v1.8.3
Update Kubernetes from v1.8.2 to v1.8.3
2017-11-09 07:41:01 +01:00
* Kubernetes v1.8.3
Update bootkube and terraform-render-bootkube to v0.8.2
2017-11-11 05:01:37 +01:00
* Run etcd on-host, across controllers
* Promote AWS platform to beta
* Use kubernetes-incubator/bootkube v0.8.2
Promote AWS platform from alpha to beta
2017-11-07 06:19:11 +01:00
Change worker managed instance group to span zones in region * Change Google Cloud module to require the `region` variable * Workers are created in random zones within the given region * Tolerate Google Cloud zone failures or capacity issues * If workers are preempted (if enabled), replacement instances can be drawn from any zone in the region, which should avoid scheduling issues that were possible before if a single zone aggressively preempts instances (presumably due to Google Cloud capacity)
2017-11-04 18:57:12 +01:00
#### Google Cloud
Remove controller_preemptible option on Google Cloud * Controller preemption is not safe or covered in documentation. Delete the option, the variable is a holdover from old experiments * Note, worker_preemeptible is still a great feature that's supported
2017-11-04 19:48:50 +01:00
* Add required variable `region` (e.g. "us-central1")
Run etcd cluster on-host, across controllers on Google Cloud * Change controllers from a managed group to individual instances * Create discrete DNS records to each controller's private IP for etcd * Change etcd to run on-host, across controllers (etcd-member.service) * Reduce time to bootstrap a cluster * Deprecate self-hosted-etcd on the Google Cloud platform
2017-11-05 20:01:50 +01:00
* Reduce time to bootstrap a cluster
* Change etcd to run on-host, across controllers (etcd-member.service)
Create controller instances across zones in the region * Change controller instances to automatically span zones in a region * Remove the `zone` required variable
2017-11-05 20:09:03 +01:00
* Change controller instances to automatically span zones in the region
* Change worker managed instance group to automatically span zones in the region
Improve internal firewall rules on Google Cloud * Whitelist internal traffic between controllers and workers * Switch to tag-based firewall policies rather than source IP
2017-11-08 08:21:12 +01:00
* Improve internal firewall rules and use tag-based firewall policies
Run etcd cluster on-host, across controllers on Google Cloud * Change controllers from a managed group to individual instances * Create discrete DNS records to each controller's private IP for etcd * Change etcd to run on-host, across controllers (etcd-member.service) * Reduce time to bootstrap a cluster * Deprecate self-hosted-etcd on the Google Cloud platform
2017-11-05 20:01:50 +01:00
* Remove support for self-hosted etcd
Create controller instances across zones in the region * Change controller instances to automatically span zones in a region * Remove the `zone` required variable
2017-11-05 20:09:03 +01:00
* Remove the `zone` required variable
* Remove the `controller_preemptible` optional variable
Change worker managed instance group to span zones in region * Change Google Cloud module to require the `region` variable * Workers are created in random zones within the given region * Tolerate Google Cloud zone failures or capacity issues * If workers are preempted (if enabled), replacement instances can be drawn from any zone in the region, which should avoid scheduling issues that were possible before if a single zone aggressively preempts instances (presumably due to Google Cloud capacity)
2017-11-04 18:57:12 +01:00
Run etcd cluster on-host, across controllers on AWS * Change controllers ASG to heterogeneous EC2 instances * Create DNS records for each controller's private IP for etcd * Change etcd to run on-host, across controllers (etcd-member.service) * Reduce time to bootstrap a cluster * Deprecate self-hosted-etcd on the AWS platform
2017-11-06 07:36:50 +01:00
#### AWS
Promote AWS platform from alpha to beta
2017-11-07 06:19:11 +01:00
* Promote AWS platform to beta
Run etcd cluster on-host, across controllers on AWS * Change controllers ASG to heterogeneous EC2 instances * Create DNS records for each controller's private IP for etcd * Change etcd to run on-host, across controllers (etcd-member.service) * Reduce time to bootstrap a cluster * Deprecate self-hosted-etcd on the AWS platform
2017-11-06 07:36:50 +01:00
* Reduce time to bootstrap a cluster
* Change etcd to run on-host, across controllers (etcd-member.service)
Promote AWS platform from alpha to beta
2017-11-07 06:19:11 +01:00
* Fix firewall rules for multi-controller kubelet scraping and node-exporter
Run etcd cluster on-host, across controllers on AWS * Change controllers ASG to heterogeneous EC2 instances * Create DNS records for each controller's private IP for etcd * Change etcd to run on-host, across controllers (etcd-member.service) * Reduce time to bootstrap a cluster * Deprecate self-hosted-etcd on the AWS platform
2017-11-06 07:36:50 +01:00
* Remove support for self-hosted etcd
addons: Add better alerting rules to Prometheus manifests * Adapt the coreos/prometheus-operator alerting rules for Typhoon, https://github.com/coreos/prometheus-operator/tree/master/contrib/kube-prometheus/manifests * Add controller manager and scheduler shim services to let prometheus discover them via service endpoints * Fix several alert rules to use service endpoint discovery * A few rules still don't do much, but they default to green
2017-11-08 10:35:56 +01:00
#### Addons
* Add Prometheus 2.0 addon with alerting rules
* Add Grafana dashboard for observing metrics
Update Kubernetes from v1.8.1 to v1.8.2 * Kubernetes v1.8.2 fixes a memory leak in the v1.8.1 apiserver * Switch to using the `gcr.io/google_containers/hyperkube` for the on-host kubelet and shutdown drains * Update terraform-render-bootkube manifests generation * Update flannel from v0.8.0 to v0.9.0 * Add `hairpinMode` to flannel CNI config * Add `--no-negcache` to kube-dns dnsmasq
2017-10-25 06:34:29 +02:00
## v1.8.2
* Kubernetes v1.8.2
* Fixes a memory leak in the v1.8.1 apiserver ([kubernetes#53485](https://github.com/kubernetes/kubernetes/issues/53485))
* Switch to using the `gcr.io/google_containers/hyperkube`
* Update flannel from v0.8.0 to v0.9.0
* Add `hairpinMode` to flannel CNI config
* Add `--no-negcache` to kube-dns dnsmasq
Bump bootkube and terraform-render-bootkube to v0.8.1 * Use the v0.8.1 tagged terraform-render-bootkube module * Use the v0.8.1 quay.io/coreos/bootkube image to bootstrap
2017-10-28 21:50:37 +02:00
* Use kubernetes-incubator/bootkube v0.8.1
Update Kubernetes from v1.8.1 to v1.8.2 * Kubernetes v1.8.2 fixes a memory leak in the v1.8.1 apiserver * Switch to using the `gcr.io/google_containers/hyperkube` for the on-host kubelet and shutdown drains * Update terraform-render-bootkube manifests generation * Update flannel from v0.8.0 to v0.9.0 * Add `hairpinMode` to flannel CNI config * Add `--no-negcache` to kube-dns dnsmasq
2017-10-25 06:34:29 +02:00
Update AWS, DO, BM Kubernetes from v1.7.7 to v1.8.1 * Update from bootkube v0.7.0 to v0.8.0 * Leave Google Cloud update to a followup commit
2017-10-09 08:49:29 +02:00
## v1.8.1
* Kubernetes v1.8.1
* Use kubernetes-incubator/bootkube v0.8.0
digital-ocean: Run etcd cluster on-host, across controllers * Run etcd peers with TLS across controller nodes * Deprecate self-hosted-etcd on the Digital Ocean platform * Distribute etcd TLS certificates as part of initial provisioning * Check the status of etcd by running `systemctl status etcd-member`
2017-10-04 09:07:48 +02:00
#### Digital Ocean
* Run etcd cluster across controller nodes (etcd-member.service)
* Remove support for self-hosted etcd
Update AWS, DO, BM Kubernetes from v1.7.7 to v1.8.1 * Update from bootkube v0.7.0 to v0.8.0 * Leave Google Cloud update to a followup commit
2017-10-09 08:49:29 +02:00
* Reduce time to bootstrap a cluster
digital-ocean: Run etcd cluster on-host, across controllers * Run etcd peers with TLS across controller nodes * Deprecate self-hosted-etcd on the Digital Ocean platform * Distribute etcd TLS certificates as part of initial provisioning * Check the status of etcd by running `systemctl status etcd-member`
2017-10-04 09:07:48 +02:00
Update Kubernetes from v1.7.5 to v1.7.7 * Update from bootkube v0.6.2 to v0.7.0 * Use renamed terraform-render-bootkube. Renamed from bootkube-terraform to meet Terraform Module requirements
2017-10-04 05:48:24 +02:00
## v1.7.7
* Kubernetes v1.7.7
* Use kubernetes-incubator/bootkube v0.7.0
* Update kube-dns to 1.14.5 to fix dnsmasq [vulnerability](https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html)
* Calico v2.6.1
* flannel-cni v0.3.0
* Update flannel CNI config to fix hostPort
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
## v1.7.5
* Kubernetes v1.7.5
Update Kubernetes from v1.7.5 to v1.7.7 * Update from bootkube v0.6.2 to v0.7.0 * Use renamed terraform-render-bootkube. Renamed from bootkube-terraform to meet Terraform Module requirements
2017-10-04 05:48:24 +02:00
* Use kubernetes-incubator/bootkube v0.6.2
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
* Add AWS Terraform module (alpha)
* Add support for Calico networking (bare-metal, Google Cloud, AWS)
* Change networking default from "flannel" to "calico"
#### AWS
* Add `network_mtu` to allow CNI interface MTU customization
#### Bare-Metal
* Add `network_mtu` to allow CNI interface MTU customization
bare-metal: Remove support for experimental_self_hosted_etcd * Transition from discouraging self-hosted etcd for bare-metal, to removing it as an option * See #13 and FAQ for self-hosted etcd discussion
2017-09-23 21:52:50 +02:00
* Remove support for `experimental_self_hosted_etcd`
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
## v1.7.3
* Kubernetes v1.7.3
Fix typos in docs and CONTRIBUTING.md
2017-12-09 18:26:26 +01:00
* Use kubernetes-incubator/bootkube v0.6.1
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
#### Digital Ocean
* Add cloud firewall rules (requires Terraform v0.10)
* Change nodes tags from strings to DO tags
## v1.7.1
* Kubernetes v1.7.1
Fix typos in docs and CONTRIBUTING.md
2017-12-09 18:26:26 +01:00
* Use kubernetes-incubator/bootkube v0.6.0
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
* Add Bare-Metal Terraform module (stable)
* Add Digital Ocean Terraform module (beta)
#### Google Cloud
* Remove `k8s_domain_name` variable, `cluster_name` + `dns_zone` resolves to controllers
* Rename `dns_base_zone` to `dns_zone`
* Rename `dns_base_zone_name` to `dns_zone_name`
## v1.6.7
* Kubernetes v1.6.7
Fix typos in docs and CONTRIBUTING.md
2017-12-09 18:26:26 +01:00
* Use kubernetes-incubator/bootkube v0.5.1
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
## v1.6.6
* Kubernetes v1.6.6
Fix typos in docs and CONTRIBUTING.md
2017-12-09 18:26:26 +01:00
* Use kubernetes-incubator/bootkube v0.4.5
README: Add IRC link, CHANGES.md, and minor fixes
2017-09-23 22:02:18 +02:00
* Disable locksmithd on hosts, in favor of [CLUO](https://github.com/coreos/container-linux-update-operator).
## v1.6.4
* Kubernetes v1.6.4
* Add Google Cloud Terraform module (stable)
## Earlier
Earlier versions, back to v1.3.0, used different designs and mechanisms.