Replace skew shortcode parameters
Jihoon Seo
parent
3a0d817bb8
commit
e7caadc564
|
|
@ -102,7 +102,7 @@ For each mode, there are two labels that determine the policy used:
|
|||
pod-security.kubernetes.io/<MODE>: <LEVEL>
|
||||
|
||||
# Optional: per-mode version label that can be used to pin the policy to the
|
||||
# version that shipped with a given Kubernetes minor version (for example v{{< skew latestVersion >}}).
|
||||
# version that shipped with a given Kubernetes minor version (for example v{{< skew currentVersion >}}).
|
||||
#
|
||||
# MODE must be one of `enforce`, `audit`, or `warn`.
|
||||
# VERSION must be a valid Kubernetes minor version, or `latest`.
|
||||
|
|
|
|||
|
|
@ -258,7 +258,7 @@ standardized label to target a specific namespace.
|
|||
|
||||
## What you can't do with network policies (at least, not yet)
|
||||
|
||||
As of Kubernetes {{< skew latestVersion >}}, the following functionality does not exist in the NetworkPolicy API, but you might be able to implement workarounds using Operating System components (such as SELinux, OpenVSwitch, IPTables, and so on) or Layer 7 technologies (Ingress controllers, Service Mesh implementations) or admission controllers. In case you are new to network security in Kubernetes, its worth noting that the following User Stories cannot (yet) be implemented using the NetworkPolicy API.
|
||||
As of Kubernetes {{< skew currentVersion >}}, the following functionality does not exist in the NetworkPolicy API, but you might be able to implement workarounds using Operating System components (such as SELinux, OpenVSwitch, IPTables, and so on) or Layer 7 technologies (Ingress controllers, Service Mesh implementations) or admission controllers. In case you are new to network security in Kubernetes, its worth noting that the following User Stories cannot (yet) be implemented using the NetworkPolicy API.
|
||||
|
||||
- Forcing internal cluster traffic to go through a common gateway (this might be best served with a service mesh or other proxy).
|
||||
- Anything TLS related (use a service mesh or ingress controller for this).
|
||||
|
|
|
|||
|
|
@ -550,7 +550,7 @@ for more information.
|
|||
|
||||
### pod-security.kubernetes.io/enforce-version
|
||||
|
||||
Example: `pod-security.kubernetes.io/enforce-version: "{{< skew latestVersion >}}"`
|
||||
Example: `pod-security.kubernetes.io/enforce-version: "{{< skew currentVersion >}}"`
|
||||
|
||||
Used on: Namespace
|
||||
|
||||
|
|
@ -577,7 +577,7 @@ for more information.
|
|||
|
||||
### pod-security.kubernetes.io/audit-version
|
||||
|
||||
Example: `pod-security.kubernetes.io/audit-version: "{{< skew latestVersion >}}"`
|
||||
Example: `pod-security.kubernetes.io/audit-version: "{{< skew currentVersion >}}"`
|
||||
|
||||
Used on: Namespace
|
||||
|
||||
|
|
@ -606,7 +606,7 @@ for more information.
|
|||
|
||||
### pod-security.kubernetes.io/warn-version
|
||||
|
||||
Example: `pod-security.kubernetes.io/warn-version: "{{< skew latestVersion >}}"`
|
||||
Example: `pod-security.kubernetes.io/warn-version: "{{< skew currentVersion >}}"`
|
||||
|
||||
Used on: Namespace
|
||||
|
||||
|
|
|
|||
|
|
@ -544,8 +544,8 @@ field when using `--config`. This option will control the versions
|
|||
of kube-apiserver, kube-controller-manager, kube-scheduler and kube-proxy.
|
||||
|
||||
Example:
|
||||
* kubeadm is at {{< skew latestVersion >}}
|
||||
* `kubernetesVersion` must be at {{< skew latestVersion >}} or {{< skew prevMinorVersion >}}
|
||||
* kubeadm is at {{< skew currentVersion >}}
|
||||
* `kubernetesVersion` must be at {{< skew currentVersion >}} or {{< skew currentVersionAddMinor -1 >}}
|
||||
|
||||
### kubeadm's skew against the kubelet
|
||||
|
||||
|
|
@ -553,8 +553,8 @@ Similarly to the Kubernetes version, kubeadm can be used with a kubelet version
|
|||
version as kubeadm or one version older.
|
||||
|
||||
Example:
|
||||
* kubeadm is at {{< skew latestVersion >}}
|
||||
* kubelet on the host must be at {{< skew latestVersion >}} or {{< skew prevMinorVersion >}}
|
||||
* kubeadm is at {{< skew currentVersion >}}
|
||||
* kubelet on the host must be at {{< skew currentVersion >}} or {{< skew currentVersionAddMinor -1 >}}
|
||||
|
||||
### kubeadm's skew against kubeadm
|
||||
|
||||
|
|
@ -567,17 +567,17 @@ the same node with `kubeadm upgrade`. Similar rules apply to the rest of the kub
|
|||
with the exception of `kubeadm upgrade`.
|
||||
|
||||
Example for `kubeadm join`:
|
||||
* kubeadm version {{< skew latestVersion >}} was used to create a cluster with `kubeadm init`
|
||||
* Joining nodes must use a kubeadm binary that is at version {{< skew latestVersion >}}
|
||||
* kubeadm version {{< skew currentVersion >}} was used to create a cluster with `kubeadm init`
|
||||
* Joining nodes must use a kubeadm binary that is at version {{< skew currentVersion >}}
|
||||
|
||||
Nodes that are being upgraded must use a version of kubeadm that is the same MINOR
|
||||
version or one MINOR version newer than the version of kubeadm used for managing the
|
||||
node.
|
||||
|
||||
Example for `kubeadm upgrade`:
|
||||
* kubeadm version {{< skew prevMinorVersion >}} was used to create or upgrade the node
|
||||
* The version of kubeadm used for upgrading the node must be at {{< skew prevMinorVersion >}}
|
||||
or {{< skew latestVersion >}}
|
||||
* kubeadm version {{< skew currentVersionAddMinor -1 >}} was used to create or upgrade the node
|
||||
* The version of kubeadm used for upgrading the node must be at {{< skew currentVersionAddMinor -1 >}}
|
||||
or {{< skew currentVersion >}}
|
||||
|
||||
To learn more about the version skew between the different Kubernetes component see
|
||||
the [Version Skew Policy](https://kubernetes.io/releases/version-skew-policy/).
|
||||
|
|
|
|||
|
|
@ -21,8 +21,8 @@ At a high level, the steps you perform are:
|
|||
## {{% heading "prerequisites" %}}
|
||||
|
||||
You must have an existing cluster. This page is about upgrading from Kubernetes
|
||||
{{< skew prevMinorVersion >}} to Kubernetes {{< skew latestVersion >}}. If your cluster
|
||||
is not currently running Kubernetes {{< skew prevMinorVersion >}} then please check
|
||||
{{< skew currentVersionAddMinor -1 >}} to Kubernetes {{< skew currentVersion >}}. If your cluster
|
||||
is not currently running Kubernetes {{< skew currentVersionAddMinor -1 >}} then please check
|
||||
the documentation for the version of Kubernetes that you plan to upgrade to.
|
||||
|
||||
## Upgrade approaches
|
||||
|
|
@ -55,7 +55,7 @@ At this point you should
|
|||
[install the latest version of `kubectl`](/docs/tasks/tools/).
|
||||
|
||||
For each node in your cluster, [drain](/docs/tasks/administer-cluster/safely-drain-node/)
|
||||
that node and then either replace it with a new node that uses the {{< skew latestVersion >}}
|
||||
that node and then either replace it with a new node that uses the {{< skew currentVersion >}}
|
||||
kubelet, or upgrade the kubelet on that node and bring the node back into service.
|
||||
|
||||
### Other deployments {#upgrade-other}
|
||||
|
|
|
|||
|
|
@ -244,7 +244,7 @@ serverTLSBootstrap: true
|
|||
```
|
||||
|
||||
If you have already created the cluster you must adapt it by doing the following:
|
||||
- Find and edit the `kubelet-config-{{< skew latestVersion >}}` ConfigMap in the `kube-system` namespace.
|
||||
- Find and edit the `kubelet-config-{{< skew currentVersion >}}` ConfigMap in the `kube-system` namespace.
|
||||
In that ConfigMap, the `kubelet` key has a
|
||||
[KubeletConfiguration](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration)
|
||||
document as its value. Edit the KubeletConfiguration document to set `serverTLSBootstrap: true`.
|
||||
|
|
|
|||
|
|
@ -438,8 +438,8 @@ to 127.0.0.1. If your pod relies on virtual hosts, which is probably the more co
|
|||
case, you should not use `host`, but rather set the `Host` header in `httpHeaders`.
|
||||
|
||||
For an HTTP probe, the kubelet sends two request headers in addition to the mandatory `Host` header:
|
||||
`User-Agent`, and `Accept`. The default values for these headers are `kube-probe/{{< skew latestVersion >}}`
|
||||
(where `{{< skew latestVersion >}}` is the version of the kubelet ), and `*/*` respectively.
|
||||
`User-Agent`, and `Accept`. The default values for these headers are `kube-probe/{{< skew currentVersion >}}`
|
||||
(where `{{< skew currentVersion >}}` is the version of the kubelet ), and `*/*` respectively.
|
||||
|
||||
You can override the default headers by defining `.httpHeaders` for the probe; for example
|
||||
|
||||
|
|
|
|||
|
|
@ -38,7 +38,7 @@ plugins:
|
|||
#
|
||||
# Version label values must be one of:
|
||||
# - "latest" (default)
|
||||
# - specific version like "v{{< skew latestVersion >}}"
|
||||
# - specific version like "v{{< skew currentVersion >}}"
|
||||
defaults:
|
||||
enforce: "privileged"
|
||||
enforce-version: "latest"
|
||||
|
|
@ -78,7 +78,7 @@ plugins:
|
|||
#
|
||||
# Version label values must be one of:
|
||||
# - "latest" (default)
|
||||
# - specific version like "v{{< skew latestVersion >}}"
|
||||
# - specific version like "v{{< skew currentVersion >}}"
|
||||
defaults:
|
||||
enforce: "privileged"
|
||||
enforce-version: "latest"
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@ This manifest defines a Namespace `my-baseline-namespace` that:
|
|||
- _Blocks_ any pods that don't satisfy the `baseline` policy requirements.
|
||||
- Generates a user-facing warning and adds an audit annotation to any created pod that does not
|
||||
meet the `restricted` policy requirements.
|
||||
- Pins the versions of the `baseline` and `restricted` policies to v{{< skew latestVersion >}}.
|
||||
- Pins the versions of the `baseline` and `restricted` policies to v{{< skew currentVersion >}}.
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
|
|
@ -35,13 +35,13 @@ metadata:
|
|||
name: my-baseline-namespace
|
||||
labels:
|
||||
pod-security.kubernetes.io/enforce: baseline
|
||||
pod-security.kubernetes.io/enforce-version: v{{< skew latestVersion >}}
|
||||
pod-security.kubernetes.io/enforce-version: v{{< skew currentVersion >}}
|
||||
|
||||
# We are setting these to our _desired_ `enforce` level.
|
||||
pod-security.kubernetes.io/audit: restricted
|
||||
pod-security.kubernetes.io/audit-version: v{{< skew latestVersion >}}
|
||||
pod-security.kubernetes.io/audit-version: v{{< skew currentVersion >}}
|
||||
pod-security.kubernetes.io/warn: restricted
|
||||
pod-security.kubernetes.io/warn-version: v{{< skew latestVersion >}}
|
||||
pod-security.kubernetes.io/warn-version: v{{< skew currentVersion >}}
|
||||
```
|
||||
|
||||
## Add labels to existing namespaces with `kubectl label`
|
||||
|
|
@ -82,10 +82,10 @@ kubectl get namespaces --selector='!pod-security.kubernetes.io/enforce'
|
|||
### Applying to a single namespace
|
||||
|
||||
You can update a specific namespace as well. This command adds the `enforce=restricted`
|
||||
policy to `my-existing-namespace`, pinning the restricted policy version to v{{< skew latestVersion >}}.
|
||||
policy to `my-existing-namespace`, pinning the restricted policy version to v{{< skew currentVersion >}}.
|
||||
|
||||
```shell
|
||||
kubectl label --overwrite ns my-existing-namespace \
|
||||
pod-security.kubernetes.io/enforce=restricted \
|
||||
pod-security.kubernetes.io/enforce-version=v{{< skew latestVersion >}}
|
||||
pod-security.kubernetes.io/enforce-version=v{{< skew currentVersion >}}
|
||||
```
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ type: docs
|
|||
|
||||
<!-- overview -->
|
||||
|
||||
The Kubernetes project maintains release branches for the most recent three minor releases ({{< skew latestVersion >}}, {{< skew prevMinorVersion >}}, {{< skew oldestMinorVersion >}}). Kubernetes 1.19 and newer receive [approximately 1 year of patch support](/releases/patch-releases/#support-period). Kubernetes 1.18 and older received approximately 9 months of patch support.
|
||||
The Kubernetes project maintains release branches for the most recent three minor releases ({{< skew currentVersion >}}, {{< skew currentVersionAddMinor -1 >}}, {{< skew currentVersionAddMinor -2 >}}). Kubernetes 1.19 and newer receive [approximately 1 year of patch support](/releases/patch-releases/#support-period). Kubernetes 1.18 and older received approximately 9 months of patch support.
|
||||
|
||||
Kubernetes versions are expressed as **x.y.z**,
|
||||
where **x** is the major version, **y** is the minor version, and **z** is the patch version, following [Semantic Versioning](https://semver.org/) terminology.
|
||||
|
|
@ -22,6 +22,6 @@ More information in the [version skew policy](/releases/version-skew-policy/) do
|
|||
|
||||
## Upcoming Release
|
||||
|
||||
Check out the [schedule](https://github.com/kubernetes/sig-release/tree/master/releases/release-{{< skew nextMinorVersion >}}) for the upcoming **{{< skew nextMinorVersion >}}** Kubernetes release!
|
||||
Check out the [schedule](https://github.com/kubernetes/sig-release/tree/master/releases/release-{{< skew currentVersionAddMinor 1 >}}) for the upcoming **{{< skew currentVersionAddMinor 1 >}}** Kubernetes release!
|
||||
|
||||
## Helpful Resources
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ Specific cluster deployment tools may place additional restrictions on version s
|
|||
Kubernetes versions are expressed as **x.y.z**, where **x** is the major version, **y** is the minor version, and **z** is the patch version, following [Semantic Versioning](https://semver.org/) terminology.
|
||||
For more information, see [Kubernetes Release Versioning](https://git.k8s.io/design-proposals-archive/release/versioning.md#kubernetes-release-versioning).
|
||||
|
||||
The Kubernetes project maintains release branches for the most recent three minor releases ({{< skew latestVersion >}}, {{< skew prevMinorVersion >}}, {{< skew oldestMinorVersion >}}). Kubernetes 1.19 and newer receive approximately 1 year of patch support. Kubernetes 1.18 and older received approximately 9 months of patch support.
|
||||
The Kubernetes project maintains release branches for the most recent three minor releases ({{< skew currentVersion >}}, {{< skew currentVersionAddMinor -1 >}}, {{< skew currentVersionAddMinor -2 >}}). Kubernetes 1.19 and newer receive approximately 1 year of patch support. Kubernetes 1.18 and older received approximately 9 months of patch support.
|
||||
|
||||
Applicable fixes, including security fixes, may be backported to those three release branches, depending on severity and feasibility.
|
||||
Patch releases are cut from those branches at a [regular cadence](https://kubernetes.io/releases/patch-releases/#cadence), plus additional urgent releases, when required.
|
||||
|
|
@ -40,8 +40,8 @@ In [highly-available (HA) clusters](/docs/setup/production-environment/tools/kub
|
|||
|
||||
Example:
|
||||
|
||||
* newest `kube-apiserver` is at **{{< skew latestVersion >}}**
|
||||
* other `kube-apiserver` instances are supported at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}**
|
||||
* newest `kube-apiserver` is at **{{< skew currentVersion >}}**
|
||||
* other `kube-apiserver` instances are supported at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}**
|
||||
|
||||
### kubelet
|
||||
|
||||
|
|
@ -49,8 +49,8 @@ Example:
|
|||
|
||||
Example:
|
||||
|
||||
* `kube-apiserver` is at **{{< skew latestVersion >}}**
|
||||
* `kubelet` is supported at **{{< skew latestVersion >}}**, **{{< skew prevMinorVersion >}}**, and **{{< skew oldestMinorVersion >}}**
|
||||
* `kube-apiserver` is at **{{< skew currentVersion >}}**
|
||||
* `kubelet` is supported at **{{< skew currentVersion >}}**, **{{< skew currentVersionAddMinor -1 >}}**, and **{{< skew currentVersionAddMinor -2 >}}**
|
||||
|
||||
{{< note >}}
|
||||
If version skew exists between `kube-apiserver` instances in an HA cluster, this narrows the allowed `kubelet` versions.
|
||||
|
|
@ -58,8 +58,8 @@ If version skew exists between `kube-apiserver` instances in an HA cluster, this
|
|||
|
||||
Example:
|
||||
|
||||
* `kube-apiserver` instances are at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}**
|
||||
* `kubelet` is supported at **{{< skew prevMinorVersion >}}**, and **{{< skew oldestMinorVersion >}}** (**{{< skew latestVersion >}}** is not supported because that would be newer than the `kube-apiserver` instance at version **{{< skew prevMinorVersion >}}**)
|
||||
* `kube-apiserver` instances are at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}**
|
||||
* `kubelet` is supported at **{{< skew currentVersionAddMinor -1 >}}**, and **{{< skew currentVersionAddMinor -2 >}}** (**{{< skew currentVersion >}}** is not supported because that would be newer than the `kube-apiserver` instance at version **{{< skew currentVersionAddMinor -1 >}}**)
|
||||
|
||||
### kube-controller-manager, kube-scheduler, and cloud-controller-manager
|
||||
|
||||
|
|
@ -67,8 +67,8 @@ Example:
|
|||
|
||||
Example:
|
||||
|
||||
* `kube-apiserver` is at **{{< skew latestVersion >}}**
|
||||
* `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` are supported at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}**
|
||||
* `kube-apiserver` is at **{{< skew currentVersion >}}**
|
||||
* `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` are supported at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}**
|
||||
|
||||
{{< note >}}
|
||||
If version skew exists between `kube-apiserver` instances in an HA cluster, and these components can communicate with any `kube-apiserver` instance in the cluster (for example, via a load balancer), this narrows the allowed versions of these components.
|
||||
|
|
@ -76,9 +76,9 @@ If version skew exists between `kube-apiserver` instances in an HA cluster, and
|
|||
|
||||
Example:
|
||||
|
||||
* `kube-apiserver` instances are at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}**
|
||||
* `kube-apiserver` instances are at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}**
|
||||
* `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` communicate with a load balancer that can route to any `kube-apiserver` instance
|
||||
* `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` are supported at **{{< skew prevMinorVersion >}}** (**{{< skew latestVersion >}}** is not supported because that would be newer than the `kube-apiserver` instance at version **{{< skew prevMinorVersion >}}**)
|
||||
* `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` are supported at **{{< skew currentVersionAddMinor -1 >}}** (**{{< skew currentVersion >}}** is not supported because that would be newer than the `kube-apiserver` instance at version **{{< skew currentVersionAddMinor -1 >}}**)
|
||||
|
||||
### kubectl
|
||||
|
||||
|
|
@ -86,8 +86,8 @@ Example:
|
|||
|
||||
Example:
|
||||
|
||||
* `kube-apiserver` is at **{{< skew latestVersion >}}**
|
||||
* `kubectl` is supported at **{{< skew nextMinorVersion >}}**, **{{< skew latestVersion >}}**, and **{{< skew prevMinorVersion >}}**
|
||||
* `kube-apiserver` is at **{{< skew currentVersion >}}**
|
||||
* `kubectl` is supported at **{{< skew currentVersionAddMinor 1 >}}**, **{{< skew currentVersion >}}**, and **{{< skew currentVersionAddMinor -1 >}}**
|
||||
|
||||
{{< note >}}
|
||||
If version skew exists between `kube-apiserver` instances in an HA cluster, this narrows the supported `kubectl` versions.
|
||||
|
|
@ -95,27 +95,27 @@ If version skew exists between `kube-apiserver` instances in an HA cluster, this
|
|||
|
||||
Example:
|
||||
|
||||
* `kube-apiserver` instances are at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}**
|
||||
* `kubectl` is supported at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}** (other versions would be more than one minor version skewed from one of the `kube-apiserver` components)
|
||||
* `kube-apiserver` instances are at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}**
|
||||
* `kubectl` is supported at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}** (other versions would be more than one minor version skewed from one of the `kube-apiserver` components)
|
||||
|
||||
## Supported component upgrade order
|
||||
|
||||
The supported version skew between components has implications on the order in which components must be upgraded.
|
||||
This section describes the order in which components must be upgraded to transition an existing cluster from version **{{< skew prevMinorVersion >}}** to version **{{< skew latestVersion >}}**.
|
||||
This section describes the order in which components must be upgraded to transition an existing cluster from version **{{< skew currentVersionAddMinor -1 >}}** to version **{{< skew currentVersion >}}**.
|
||||
|
||||
### kube-apiserver
|
||||
|
||||
Pre-requisites:
|
||||
|
||||
* In a single-instance cluster, the existing `kube-apiserver` instance is **{{< skew prevMinorVersion >}}**
|
||||
* In an HA cluster, all `kube-apiserver` instances are at **{{< skew prevMinorVersion >}}** or **{{< skew latestVersion >}}** (this ensures maximum skew of 1 minor version between the oldest and newest `kube-apiserver` instance)
|
||||
* The `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` instances that communicate with this server are at version **{{< skew prevMinorVersion >}}** (this ensures they are not newer than the existing API server version, and are within 1 minor version of the new API server version)
|
||||
* `kubelet` instances on all nodes are at version **{{< skew prevMinorVersion >}}** or **{{< skew oldestMinorVersion >}}** (this ensures they are not newer than the existing API server version, and are within 2 minor versions of the new API server version)
|
||||
* In a single-instance cluster, the existing `kube-apiserver` instance is **{{< skew currentVersionAddMinor -1 >}}**
|
||||
* In an HA cluster, all `kube-apiserver` instances are at **{{< skew currentVersionAddMinor -1 >}}** or **{{< skew currentVersion >}}** (this ensures maximum skew of 1 minor version between the oldest and newest `kube-apiserver` instance)
|
||||
* The `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` instances that communicate with this server are at version **{{< skew currentVersionAddMinor -1 >}}** (this ensures they are not newer than the existing API server version, and are within 1 minor version of the new API server version)
|
||||
* `kubelet` instances on all nodes are at version **{{< skew currentVersionAddMinor -1 >}}** or **{{< skew currentVersionAddMinor -2 >}}** (this ensures they are not newer than the existing API server version, and are within 2 minor versions of the new API server version)
|
||||
* Registered admission webhooks are able to handle the data the new `kube-apiserver` instance will send them:
|
||||
* `ValidatingWebhookConfiguration` and `MutatingWebhookConfiguration` objects are updated to include any new versions of REST resources added in **{{< skew latestVersion >}}** (or use the [`matchPolicy: Equivalent` option](/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy) available in v1.15+)
|
||||
* The webhooks are able to handle any new versions of REST resources that will be sent to them, and any new fields added to existing versions in **{{< skew latestVersion >}}**
|
||||
* `ValidatingWebhookConfiguration` and `MutatingWebhookConfiguration` objects are updated to include any new versions of REST resources added in **{{< skew currentVersion >}}** (or use the [`matchPolicy: Equivalent` option](/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy) available in v1.15+)
|
||||
* The webhooks are able to handle any new versions of REST resources that will be sent to them, and any new fields added to existing versions in **{{< skew currentVersion >}}**
|
||||
|
||||
Upgrade `kube-apiserver` to **{{< skew latestVersion >}}**
|
||||
Upgrade `kube-apiserver` to **{{< skew currentVersion >}}**
|
||||
|
||||
{{< note >}}
|
||||
Project policies for [API deprecation](/docs/reference/using-api/deprecation-policy/) and
|
||||
|
|
@ -127,17 +127,17 @@ require `kube-apiserver` to not skip minor versions when upgrading, even in sing
|
|||
|
||||
Pre-requisites:
|
||||
|
||||
* The `kube-apiserver` instances these components communicate with are at **{{< skew latestVersion >}}** (in HA clusters in which these control plane components can communicate with any `kube-apiserver` instance in the cluster, all `kube-apiserver` instances must be upgraded before upgrading these components)
|
||||
* The `kube-apiserver` instances these components communicate with are at **{{< skew currentVersion >}}** (in HA clusters in which these control plane components can communicate with any `kube-apiserver` instance in the cluster, all `kube-apiserver` instances must be upgraded before upgrading these components)
|
||||
|
||||
Upgrade `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` to **{{< skew latestVersion >}}**
|
||||
Upgrade `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` to **{{< skew currentVersion >}}**
|
||||
|
||||
### kubelet
|
||||
|
||||
Pre-requisites:
|
||||
|
||||
* The `kube-apiserver` instances the `kubelet` communicates with are at **{{< skew latestVersion >}}**
|
||||
* The `kube-apiserver` instances the `kubelet` communicates with are at **{{< skew currentVersion >}}**
|
||||
|
||||
Optionally upgrade `kubelet` instances to **{{< skew latestVersion >}}** (or they can be left at **{{< skew prevMinorVersion >}}** or **{{< skew oldestMinorVersion >}}**)
|
||||
Optionally upgrade `kubelet` instances to **{{< skew currentVersion >}}** (or they can be left at **{{< skew currentVersionAddMinor -1 >}}** or **{{< skew currentVersionAddMinor -2 >}}**)
|
||||
|
||||
{{< note >}}
|
||||
Before performing a minor version `kubelet` upgrade, [drain](/docs/tasks/administer-cluster/safely-drain-node/) pods from that node.
|
||||
|
|
@ -159,7 +159,7 @@ Running a cluster with `kubelet` instances that are persistently two minor versi
|
|||
|
||||
Example:
|
||||
|
||||
If `kube-proxy` version is **{{< skew oldestMinorVersion >}}**:
|
||||
If `kube-proxy` version is **{{< skew currentVersionAddMinor -2 >}}**:
|
||||
|
||||
* `kubelet` version must be at the same minor version as **{{< skew oldestMinorVersion >}}**.
|
||||
* `kube-apiserver` version must be between **{{< skew oldestMinorVersion >}}** and **{{< skew latestVersion >}}**, inclusive.
|
||||
* `kubelet` version must be at the same minor version as **{{< skew currentVersionAddMinor -2 >}}**.
|
||||
* `kube-apiserver` version must be between **{{< skew currentVersionAddMinor -2 >}}** and **{{< skew currentVersion >}}**, inclusive.
|
||||
|
|
|
|||
Loading…
Reference in New Issue