Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Kubernetes from v1.13.5 to v1.14.0 #436

Merged
merged 2 commits into from
Apr 7, 2019
Merged

Conversation

dghubble
Copy link
Member

@dghubble dghubble commented Mar 26, 2019

Update Kubernetes from v1.13.5 to v1.14.0

Related: poseidon/terraform-render-bootstrap#123

@dghubble dghubble changed the title Update Kubernetes from v1.13.5 to v1.14.0 Update Kubernetes from v1.13.5 to v1.14 Mar 26, 2019
@dghubble dghubble force-pushed the kubernetes-v1.14 branch 2 times, most recently from 1c49328 to bb9870e Compare April 7, 2019 07:10
@dghubble
Copy link
Member Author

dghubble commented Apr 7, 2019

  • Add an enable_aggregation variable to enable the kube-apiserver aggregation layer for adding extension apiservers to clusters
  • Aggregation is disabled by default. Typhoon recommends you not enable aggregation. Consider whether less invasive ways to achieve your goals are possible and whether those goals are well-founded
  • Enabling aggregation and extension apiservers increases the attack surface of a cluster and makes extensions a part of the control plane. Admins must scrutinize and trust any extension apiserver used.
  • Passing a v1.14 CNCF conformance test requires aggregation be enabled. Having an option for aggregation keeps compliance, but retains the stricter security posture on default clusters

See: poseidon/terraform-render-bootstrap#125

@dghubble
Copy link
Member Author

dghubble commented Apr 7, 2019

CNCF conformance: cncf/k8s-conformance#536

With default options (strict):

Summarizing 1 Failure:

[Fail] [sig-api-machinery] Aggregator [It] Should be able to support the 1.10 Sample API Server using the current Aggregator [Conformance]                                                                        
/workspace/anago-v1.14.0-rc.1.5+641856db183520/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/apimachinery/aggregator.go:371                                                          

Ran 204 of 3584 Specs in 5567.772 seconds
FAIL! -- 203 Passed | 1 Failed | 0 Pending | 3380 Skipped --- FAIL: TestE2E (5567.91s)

With enable_aggregation="true" opt-in:

Ran 204 of 3584 Specs in 4980.251 seconds
SUCCESS! -- 204 Passed | 0 Failed | 0 Pending | 3380 Skipped PASS

Ginkgo ran 1 suite in 1h23m2.206574155s
Test Suite Passed

* Add an `enable_aggregation` variable to enable the kube-apiserver
aggregation layer for adding extension apiservers to clusters
* Aggregation is **disabled** by default. Typhoon recommends you not
enable aggregation. Consider whether less invasive ways to achieve your
goals are possible and whether those goals are well-founded
* Enabling aggregation and extension apiservers increases the attack
surface of a cluster and makes extensions a part of the control plane.
Admins must scrutinize and trust any extension apiserver used.
* Passing a v1.14 CNCF conformance test requires aggregation be enabled.
Having an option for aggregation keeps compliance, but retains the
stricter security posture on default clusters
@dghubble dghubble changed the title Update Kubernetes from v1.13.5 to v1.14 Update Kubernetes from v1.13.5 to v1.14.0 Apr 7, 2019
@dghubble dghubble merged commit be29f52 into master Apr 7, 2019
@dghubble dghubble deleted the kubernetes-v1.14 branch April 8, 2019 05:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant