Project: Kubernetes (Orchestration & Management / Scheduling & Orchestration)
File: CHANGELOG-1.8.md

<!-- BEGIN MUNGE: GENERATED_TOC --> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - <!-- END MUNGE: GENERATED_TOC --> <!-- NEW RELEASE NOTES ENTRY --> & filename | sha256 hash -- | -- | `d3478129e17e98e70d1108d841495cc6f54b218671c18ad0a5eb96ccfee79021` | `befa7e693f8b56ccf562f205ba6821349ad74ac8da616d0701eb7aa18c5c2739` filename | sha256 hash -- | -- | `346c8456ac850c5f6d6eb0431d8991a9104e66d42ec2e09236bf8afa7820d949` | `01b1c22d8d894645ee80dd4e0639f2c1f401583150185cdf43d61cafc1ce3b78` | `31000c9ff4619139f59d8e1221d95b0d4f9a58a8dae4fadf2b64bab8712708cf` | `8cbb0ab062dde282f77f56f551519f6e80ed6090e112927eadb77d87a4b94477` | `d6f4614e9f9cfa8bb378c3d02d0bc35a3a88639f66638dfc50ea566bb8ff64fb` | `4538a987bba8ab7330a3cd802a8f4b4f441e30b95c42f6659dde12ca6fe9389e` | `4e4d7c416165d020974d8867ba44d35b1ea7959fd741f07c0e0bff11e90d2e0d` | `3584b0520a65e09571ee15475d5e391df40e7e7803dba3dee243a426057f6390` | `5218364545d40400dec805869c47b7798abe0cdf875889ace46ffba786bcb4fa` | `40292e6ae5d37cc0a84639d0754cc9f1ce8bd333ed1714739b6e64d88e866140` filename | sha256 hash -- | -- | `701395e2f6ba0f5b53bde43ccb32ae63e17617af1ece843326d0b1927358ad87` | `7330bb1d60bc64c81fb9ed33c6ad865decbb430d78669206d9bf53c7f35e8500` | `7c6fc40ea302411742ad81b513e5a6083f93c996bba2a25ac8eecbab37e29efc` | `1f6a657e90fc2fd2fe4936ffe7ed8e6aa0f0b9eac8d051c437d99ef7a62ecfed` | `e65d30e781ff3cd681689f200653ebd5d026a48f0e76f9eb1eb08e4d52ad60b6` filename | sha256 hash -- | -- | `aa3208c4a9df95d51ddb7bb335ba30b093ce8ca55967fe1d2b08fc7a7cb6611f` | `86bc70973c4e64051073eb33374fa8be42373a17b86ee5681b59aab46a1c10bc` | `3eb94233791c50c57a56979af256f4d947963bf81039b1919e06895755aee57a` | `9d7ebb3dd33183f6c63e6dee24ec43cefddf702f41159d34b3fa9de73191cd23` | `f5ddb37299c02a331943c1d289718f148b7ef0d8262e0a2b726dee5d10d7e7df` | `1642bde6aaab0c1a46ac58b71e4004ed7369ce7803eed40aecd96987012bec81` ACTION REQUIRED: Kubernetes JSON deserializer is now case-sensitive to restore compatibility with pre-1.8 servers. If your config files contains fields with wrong case, the config files will be now invalid. (, ) fix formatAndMount func issue on Windows (, ) Cluster Autoscaler version updated to 1.0.6. Release notes: https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-1.0.6 (, ) Add --no-negcache flag to kube-dns to prevent caching of NXDOMAIN responses. (, ) fix data loss issue if using existing azure disk with partitions in disk mount (, ) Fixed API server panic during concurrent GET or LIST requests with non-empty `resourceVersion`. (, ) Fix issue that vSphere cloud provider cannot delete volume which is provisioned in datastore specified in storageclass (, ) Fix a scalability issue where high rates of event writes degraded etcd performance. (, ) fixes a memory leak in the kube-controller-manager observed when large numbers of pods with tolerations are created/deleted (, ) add external resource group support for azure disk (, ) & filename | sha256 hash -- | -- | `d2013bbc635031c1f388b53a32164447f196bf34f91f3f72f52e400eea548fd8` | `ed46ded775aea6f9a588cb2ff9ae589d36cca16900a6296a9d99f208fe4a34dc` filename | sha256 hash -- | -- | `5137f01bb56b7a46ec6aacfdd90bbb65784c97feb32efb69334c0d7d5a7ffe85` | `1752603560668b060b8ed277a8edb2879e844414e19708ee35ab03e87ffff50e` | `0ed204cbb6735407ec0eb8cd3fe99f1443550bc4c00bb6313a00851cc387a616` | `66da3e182d7289e3147dbc25bc61a2ec92bb5fa5c13fa0972446639523a9a02f` | `93541062a6e04b06f177793d1e875eb8f4ccd9f1c0e69025abf75efe3d6da0a2` | `ea38a7ad0152858aa9326cf2248fe33cb1f38c42e1c28428b7d91eb8cdff1a03` | `da651a6d058c3b4a65d145eb4ed57afb227774784ff262bb220132c5e1a9caf2` | `98b3bb4297c81fe268144d461cc97e6c18c5ad8cc7b93197050be92e7b92e906` | `5f96970061ad3b8086d27c52ec32d48e0086f780a341d9ed66ec8712ded80df5` | `49cab034eb39c827c6fa4e299d1687edb3f3956b035850887be6e040fde21c50` filename | sha256 hash -- | -- | `0ef5b508f57d575eee0fb47c6c0aca68a7da43dd50086c23082da778e2893c41` | `8d6c1831181ba1f53e62eeb61ba136b28e240ddc3d51c4f15539a624247053f2` | `00ae57855ffafcd069514d284f9c9076fb79ed63fe9be7104fa134b51ed15c36` | `774a9eb65abd8f483a8417ca79d1339783c1cb1d0e8fe2b2821ddd24ab670ec9` | `3e0805494c234544a086465dac6d868551876e2a3175c17e46e85e6d141165d5` filename | sha256 hash -- | -- | `495bc4ec731ca959951b7e9a9cff92eabc2cc83055f4efe8d25f2159aefdf867` | `b08d12bc9d66c3d4fab0cbe24fb7478910293c09b731f0a6d48631065633347e` | `50a2c150c8a0622aadffb40f4330f844d633d440187814181858b937fb0a18c7` | `2936000403e4eb07d6188aa1a1b65f60b99771c8b463174e5e3db907a923f625` | `3bd2d3b518304b0f68150ef05ecae6da8c1819f58ab15f42ce6eab1d3f6b781b` | `046341bc2f68f5d47dde21d7eb195bcdca9a973593a157677e8d46cd4c3ca530` Bump version of prometheus-to-sd to 0.2.6 to decrease log noise and include latest security patches. (, ) Fixes issue for readOnly subpath mounts for SELinux systems and when the volume mountPath already existed in the container image. (, ) Fix issue of colliding nodePorts when the cluster has services with externalTrafficPolicy=Local (, ) GCE: Fix to make the built-in `kubernetes` service properly point to the master's load balancer address in clusters that use multiple master VMs. (, ) Add a way to pass extra arguments to

(, ) kubelet: fix hangs in updating Node status after network interruptions/changes between the kubelet and API server (, ) & filename | sha256 hash -- | -- | `1515abd5e5aef927355c26e4a0e9e9f257880a2b8f357d59c9a54043f1806344` | `09d6e8f7fef8f50cd990c9679df40f9d24af4c8c5f4db6d834368228ed5edc26` filename | sha256 hash -- | -- | `24fdeffeffcb00e54356f44c2167a6657f5078be1079587aa459a179cd0cc8f3` | `9e8bf8742129c19064f97527f47210f71a0be6a62eb29abea1c104e9df4744dd` | `19374af724b2d49343f22bc0c9d7978ff98adbb6338d331eb10913511e2a3faa` | `2defbc71e6aea0f60a66876bbab34e4ff921bb8586e6afe32d67555ab8bf985a` | `211d70bf2a19e1009249ed15fc557636fc4e25e44bdd7b3919f3013f74e838f5` | `9db9915e15669a2110596f338424e4ffd9618479fd800c1fc6dfc42af316955f` | `3218404f21e18ff3dc3ac774917b421e50299834d00571e03565bab61e1e2912` | `c768ea49e3be746a55e2180f0b373e950e180b4a677ad19d601d8082d238a539` | `31ec41e9562ab9c5bd55d2b0e74db14fa38f0f8d1901b40e7226947b82302961` | `0d01df87b93e65fa19d8e6ba88655a60ad37fbd47caa50b53577c7502fe8f7fe` filename | sha256 hash -- | -- | `7db8b2ba30eaaa8dfd0424ea10700e2ee4cbd41778bd45e19d3ad401f32fbe66` | `64c1d562375a96a62960b60781bc4cd5326fe4768767ffbab7e6be7bd827119e` | `eb3fca691baf3d2dc305b073bd603b411f9495244d9fa604a591fc79c388f368` | `ecb6ea04b03c6dd71e97259545b4ce18204cbbace51a4f54790946b7296abe85` | `788bd79f06afa8cee226588b041c314caa502da9a5c42c94d7a4ab056fc47223` filename | sha256 hash -- | -- | `4b99d29fc82ea98e7a34e83fef623f4f135e7e7c4e0b03750a1b3f4c03290ebb` | `41ef1b4479ac3636dbd997d093c247791a6bffaef667ae2d90a3c76467149c84` | `4086d556a987b5fe83c44a369efb06f9d0c1c9235602ea87029f87d50629d947` | `407b01d37f69df34328902e802bfe61bc87b613420c3179a460f7b2b83cef0a7` | `770dfc5bc4ffd1c7684b87c43c97d6cabe6bf8ccdde1faf72823ad33700b05f7` | `3d32eda14421ce4b97f991599c248ea7ea6b3c28dd1f185e239819d646fdc2f3` Add MAXPODSPERNODE env so that user can use it to specify the default max pods per node for the cluster. IPALIAS_SIZE will be changed accordingly. Must have ip alias enabled. (, ) Fixes bugs that make apiserver panic when aggregating valid but not well formed OpenAPI spec (, ) Fixes issue where subpath readOnly mounts failed (, ) Bugfix allowing use of IP-aliases with custom-mode network in GCE setup scripts. (, ) removed unsafe double RLock in cpumanager (, ) & filename | sha256 hash -- | -- | `41ff4727612bca701fa3d78d20aebd4414e02627b502286094fb3129d71ee580` | `341fd3cd97849aa7e4cfdcef02f4bf1654d663b285dda2158f1c391eb6f18aa2` filename | sha256 hash -- | -- | `7783739c270e751813cf743f2b1cc4a728e3a7cdfac1a72b99118e7bcb187304` | `a9c963e8691ebe940eebb882eb73d983772fffcc0e2d94a2c3d09526ba95bc7b` | `55fd2bf9a97575e8ca66c2526b6a98d0b2576203605c2bf23b1b4be897b2fad9` | `3aecd1c34d8effd545e28a2d2f45c426d79836ce0e8a77f3b51dd62e4b38bdb0` | `7a444c58450b43b2412c09aba747db8cb51e27723b314cd910a1e751d2956fda` | `5e0bcf59d9c47d6adb821f4d828b4dc1fb1141d0827291bee66a2ce3c4c7a58f` | `a8d3726840aedde1bb61bd9ee7c1f81727d36b99ebb7396f1c55f5797768371e` | `a5d31fd50d04a3e2b966a6b94690f5f9667e00ccdc183827a52914234ef90d42` | `0ffc05c85b56636839158a669ba7515509ddde411e336e5ab46d933dd1e1fe7c` | `64e8d25e5921135e0c14ed72fb429b5afa8d592a72220ff0929ff21778e305e7` filename | sha256 hash -- | -- | `c2afbabf2e172ce7cd6a58b314d2e82e0cd6d42955a3a807567c785bbab9fea6` | `091cac55e06f585b944eea210f61183572b72f011871e21c0af16b7fc4b8d1a0` | `b5268091973a8a5ccac584b47e8ab0de3d33cbfbedd70f6d1b3a539fdb113655` | `fd21e3d11c303132ddf6511a698d1912179ed63157d05d2db6425b59336c8674` | `7a71e38782959a03deb87b20a2e63042e9f4d1a202393f49a5629ab7a3bb4871` filename | sha256 hash -- | -- | `3ca350f6d98b897f87ff9b5a6fcd4ce629a4d1e2aade40646cf9499f7d25a35b` | `2e4dbf2f60cf09dc91fd3ebebd10e861b456bd474f8b1b209e02c06736da32f3` | `fe8bc9c173584a78199fd68db5f87c9209e6bf47712713f7d459d765305f80d2` | `a5262f7f615abaf6d2762336b6a69d9822c19ec23802a1958b96e00da48bc51d` | `6f4f2244065a41ecd7447fa3175dbd8b654eb0b3e200e98845b5b5c1074803e0` | `6ef9db947227b9d0fef949f9036043ea416ba44224aca4618b3e0d21386ca438` GCE: Fix for internal load balancer management resulting in backend services with outdated instance group links. (, ) Fix user visible files creation for windows (, ) Resolves forbidden error when the `daemon-set-controller` cluster role access `controllerrevisions` resources. (, ) Update kube-dns to Version 1.14.10. Major changes: (, ) - Fix a bug in DNS resolution for externalName services and PTR records that need to query from upstream nameserver. & filename | sha256 hash -- | -- | `85069e47def15eb1f4ae3ec58e0ac25ca0edc9f238c3e6b21dd2dbfa083f740b` | `6cbbe55e690d5647cd9e1f93b7cb240d75ada634f75273544171de30d1fa50d0` filename | sha256 hash -- | -- | `e4c7a18904a4f2dbc799afd3b79a81fb920d8e17c5a8932b1e0d5b71fb21739f` | `bba23554bb132877e70981961776ee2cb1661143b6ce451f3daa4596324f2d27` | `84e6d6753efe1e0045f85a686cf8064a37b2e74b90a4fab6d938c551fa6e8230` | `9100114d069a71b61be00d8ba771a7a56a4935d67a6213f34d0f00a276abfbf8` | `de0eb00c90361ed499dff85d3c204fbda04851c1e4a2a7ff7b6ed40282ce7263` | `37a4e6eaa7137259c44db4ceb8ce9ac109385bfb83dc34fd6188583ca619e453` | `4ef8a00a3584f1971c47ae35a5c02841f0eb3c26d5d44b0805bed687a8f01407` | `c9aaebd54aa38da1fe8029dff811fba8c2e7890414f7e91559dca74bf51a6bb4` | `04fc5ced2902d6211d34f2207bb3ae238a4e3634c27c6dde9ba0b6c900c13858` | `fe64e3a2e935869d9c8f9137faaa300d65a1a5d1b27367f8152dbb9b287d886d` filename | sha256 hash -- | -- | `16c6f4346c9da0179cc309a15d16f4c0b6daa171611bddcb92ad0ee6d59f4b1f` | `ed567545ff99062af93ccf02a18070809bbcbb8efcf35e8e74b9e97a9228019f` | `bc3978e0b0824de004ac0247075c03f14d5d574a9fd6b361d2e38cbee08e2725` | `4f8391078983fa6c485e51617eb1ee6ce41a7d567d3183288ce4221c2a0ef8ee` | `61376f93a2725c30260f0b4d1bc920cff071a940a53728ba6279bb671fcaea9a` filename | sha256 hash -- | -- | `41093d26c11a29d7749230e56a850706876a16288eb1340b05dbb73d53caf168` | `f767457cafbe1e668a548c5fe60e7c9f18bcb656fcbd10783641d505b5ad06ee` | `e92148d19a2983803cfd54d423b07494a0d5063f28840b2e9ba899200de7f52d` | `66586be2bef00e525babaf3a7525c3b9f99e426e257b3bd24752750f281e9656` | `05c7f55fa2f89d9d62cf59d4ef23e45ab3e543d538aa409986d557ea7d6196b7` | `4d7d167968505135272bdf9567b0fb4e742d37ca0010844e205157a2578218b3` ACTION REQUIRED: In-place node upgrades to this release from versions 1.7.14, 1.8.9, and 1.9.4 are not supported if using subpath volumes with PVCs. Such pods should be drained from the node first. (, ) Backport of the IPAM allocator enhancements to 1.8 branch. (, ) fix the create azure file pvc failure if there is no storage account in current resource group (, ) Update kube-dns to Version 1.14.9. Major changes: (, ) - Fix for kube-dns returns NXDOMAIN when not yet synced with apiserver. - Don't generate empty record for externalName service. - Add validation for upstreamNameserver port. - Update go version to 1.9.3. Fix mounting of UNIX sockets(and other special files) in subpaths (, ) Fix GCE etcd scripts to pass in all required parameters for the etcd migration utility to correctly perform HA upgrades and downgrades (, ) On AWS kubelet returns an error when started under conditions that do not allow it to work (AWS has not yet tagged the instance). (, ) fixed foreground deletion of podtemplates (, ) Timeout docker queries to prevent node going NotReady indefinitely. (, ) Fix bug allowing garbage collector to enter a broken state that could only be fixed by restarting the controller-manager. (, ) Update Cluster Autoscaler version to 1.0.5 to fix security vulnerabilities (, ) Support new NODEOSDISTRIBUTION 'custom' on GCE (, ) Fixed missing error checking that could cause kubelet to crash in a race condition. (, ) Introduced `--http2-max-streams-per-connection` command line flag on api-servers and set default to 1000 for aggregated API

(, ) Fixes storage e2e test failures in GKE regional clusters. (, ) , ) fix device name change issue for azure disk (, ) Use GCE metadata proxy 0.1.4-r1 to pick up security fixes. (, ) & filename | sha256 hash -- | -- | `021c0f968c7b3facd48e2cf250eec9acc250dae33627025a0762fe9db700d063` | `b2848ab41200fc5a8a780e860543e682dacd687d919e000038416de8641620d9` filename | sha256 hash -- | -- | `55dcca2eba20f864e2ba9945b8b5babf2eb5cc7e80852159c6c32de9cc76374d` | `334b9816260b8802030f4d50a7f86c1084235c628fe51e6ef09c8837b77bb0c0` | `e267d233fe7015b20bad48758ed7ba0c7cc5d896d6c721931443df78132ab4cc` | `8ebcc183c59482b259fcc26bdcf6869ada44555708ae55a80d311e66c730721a` | `17b39001b967475382374174b7d2a5f4b1a37225be04c5edb5e722ef8eb64ca0` | `1ff6a2c706d103c8207bf1c3844d9d19dc17a50f8a1c70efeb8e6eb2d9c05e35` | `3bdcdf580dda212e54d4532e054ab640dc683495039fee22bd3b6d925d888383` | `c4fdf17c3ac91a1652aec431073d12ceaf9d11656d3ded700106bfdb722e7846` | `b75b22bebd90ca27d68263143f50695b173745fceac3077fb81a0c52ca0637d5` | `2e2e2dabef8bc6d096dd00143bcce9f6f76232dffef8cb9c62f809a337c883d6` filename | sha256 hash -- | -- | `35037ce8764ae1620daf2dc870f23b53bc9091c2ff51a74cc82b1a1bfd05cff6` | `42e9c10f726773028b060db1363e5e92ab718af8e0ab79a0c298c3d3a15002e0` | `d7443bef32a43f23627c52d65a4b5643efce97127fceed1d662562541eb74a61` | `c149282b4b1e0fc33444b2166489a66bff7817feed08f030e493694901c759d8` | `86a5090d7745b7c1f949023bd44d36cbbe7fc679bf27adac6406a19483f00832` filename | sha256 hash -- | -- | `c2b4a3107ad42199800864bc3eeba44b9c48ab0d5e9a2d7e6056beb8120b8335` | `77b4735367f4029a47601d352e6c1bc88838c95c5ddc67cd4a16932e3bf4cfcf` | `791f100738aaa80014b01d5f16581142e3dc13cc92f80b4c62563cac782faa28` | `c00ce5f56f5ac8d283a00807fd5374be19f819e5bae47045bc31ee668a96b071` | `fd602c74605aa370ee37c52467da34eb8e73c621f82d71f3ce09a54591f93f5e` | `bdaaf628a38f9cf2134af302b941beb51d0f0f94431131e1c92c532e98a03098` gce: fixes race condition in ServiceController, where nodes weren't updated in the node sync loop, by updating TargetPools in the ensureExternalLoadBalancer call. (, ) fix azure file plugin failure issue on Windows after node restart (, ) Get parent dir via canonical absolute path when trying to judge mount-point (, ) Fix a regression that prevented using `subPath` volume mounts with secret, configMap, projected, and downwardAPI volumes (, ) Set node external IP for azure node when disabling UseInstanceMetadata (, ) , ) Bug fix: Clusters with GCE feature 'DiskAlphaAPI' enabled were unable to dynamically provision GCE PD volumes. (, ) & filename | sha256 hash -- | -- | `5d85066065a411c120d54c7f5e3f426b4b1557c36c98af12273f72c6a2f43428` | `8d4bb9187125862cd54bd0c8ba4d01001fcfd1f53bc38ec6045c3aa29882d775` filename | sha256 hash -- | -- | `0a029d72489839f35f207f7aeca0d2d1e1a337c9ed55351c5142794c36f95c26` | `1a72a7a3ceb4c639d3bf6915e2a69d9934d7a8f060bb8c465c22226ed9cdef90` | `cc1d712d044fa5f079fcb758fe88c76156a373a073a619757a10cc7028690b7b` | `e299bebe3f4a4186cbcff5e8f012404f43513ae8b6d3f8524bbfa2ef05de49d9` | `4c6f8cf209f46ad0f721fb6aad60f8793864a10c9df8c30cc2a1d492f2972029` | `272b4dc4f516b4aa828513fe710eebab36c349669cbfa260fbb2920f3a781189` | `01a6e8e7ad1e9906873123216ef0f57477b6ba07e08017cbf3ac4d0000072620` | `8de019c2a979278ef6433026eeb9eb4e7067a08d577df38a21ceaaa293ace3f8` | `cb25b69a410d7295506679da1a8d2fd2032344bee020bcad86dd1f5136f12350` | `a37b37d4ea81d67c63f22d09b19b02727f5e7c6539c47faeb1b557ed5e944e6d` filename | sha256 hash -- | -- | `72ae9d0fcd2485cbac8b81587d967d71e76c5d3f6c37b336b2f052c5b1b5a20d` | `2134516699574aafaa45a0c70239055d4b2d67c1234da2534e5eb07ef0f99232` | `ecf644fb2882ed507d56b01ee4991b768e8233314ef942ec2a8aba0d9d247104` | `d455e7485e88dbf73af09b63f1a1c0bc44c9ab1909bbb4e23179e435ccd57b2b` | `00f2633644e31baa1bef45bae3c97d972c509e165b6577a4a785dca906dbead8` filename | sha256 hash -- | -- | `76604bc98d2e221b70bb73d12789cc5553aa601c2a7b4056c7ed2e06112c8e97` | `d07069b31f0edc833b19f32d1b516f77728613efaf913e3586d1ff79dbe1e82b` | `6b38b9cdb245a9777a1eb7bebd2bc860476f971f117dbf7ad5bea4d112a4c293` | `0e63b12bbc46b928954cbbd25183e6abfe0c92109f3eddad1f6962ddbde5d252` | `ce52ce8137ec5aa3ba9db58b1f0a67d86ad38aab9ca44989b77a0364347ad6cf` | `0ce7cbe4257232f04c528a2766f639afaeb71af729836dea726d9d06ddb2c45c` Fixes CVE-2017-1002101 - See https://issue.k8s.io/60813 for details (, ) Changes secret, configMap, downwardAPI and projected volumes to mount read-only, instead of allowing applications to write data and then reverting it automatically. Until version 1.11, setting the feature gate ReadOnlyAPIDataVolumes=false will preserve the old behavior. (, ) Update dashboard version to v1.8.3 (, ) Fixes a case when Deployment with recreate strategy could get stuck on old failed Pod. (, ) fix race condition issue when detaching azure disk (, ) Fix kubelet PVC stale metrics (, ) Restores the ability of older clients to delete and scale jobs with initContainers (, ) Fix race causing apiserver crashes during etcd healthchecking (, ) Increase allowed lag for ssh key sync loop in tunneler to allow for one failure (, ) Fixed a race condition in k8s.io/client-go/tools/cache.SharedInformer that could violate the sequential delivery guarantee and cause panics on shutdown. (, ) Fixed an issue where Portworx volume driver wasn't passing namespace and annotations to the Portworx Create API. (, ) Node's providerID is following Azure resource ID format now when useInstanceMetadata is enabled (, ) & filename | sha256 hash -- | -- | `2a89a7498e982847bd07ba15abebae3205c793c5d9e2d3d392423023213f3e85` | `e520e6729b34ccfe8ae178e59d5effbeae48a46fbc853a47d64fab7e061816a8` filename | sha256 hash -- | -- | `c4a413fd240d10af970589897a320f194ef4d683227dc9dcec35592e6222617c` | `fcbdf1961d8d084debf124c044c0d07696542699113323288ac90528cff03286` | `664d7b9a6a9d6f3245018f4dad34c16f551ab3f6fe242bd01761c11d7d782b19` | `3d1b9c175b2d978f266f0af857153e83e428136bcb981c639f2af06f7d500dff` | `b35d6bac9d3822805cfde0837384d9f22836f8b222c3c554e2dc19aea5782387` | `a06f6d5c62954474587916710944332eb9b1f22eab6e0740fa643519c05e268f` | `afd73eb646777d1437c1fd3463414f954e4f1f67c8000a5ca7322dbce760c39d` | `05b2eb492c4235488cf121892e9e89a8d5ebceb3f821658705e747aa3cc40046` | `4076df765481c3ea4a90accb217e32253830ae51aa6d82082c99e763f336fd85` | `d173d230f57e37dcd181027aa2940926bb14fbd0992df84077d09f0ecdeb4252` filename | sha256 hash -- | -- | `212aec6cef23112964adc4deb307d07b1ca44c41478c6ed5f6af0c72e0c78d62` | `73841a7c2052a41fd2ce3caefad7a20a4086acafd7885265a07048e70c1306c7` | `04061257023dfd595c31a5ae7f1b0dade9f613ee2ee1e488008adf5025e6eddf` | `3fe493caa9b36b9b6b72f501977a63231f35120c3c9ae6c0dc7ccfeba27c1e8e` | `9ee6b7bf446d3b57aa97d061c4880cb16345cf4790f3b228ad96674ded944ce4` filename | sha256 hash -- | -- | `e399b89be7cbbb8f71d87fd39609d97a77998173ec82c9e6c786124ddf7a5bba` | `3704f7caca483b8a9590b52ba9f1910d3151f616126ecaaff99823e9081a634f` | `17f0d9a7019bd13a86fd272459efb91630701bbf195cd57ed531428ec87e26ef` | `e53d4c510a75696d5b28ca54be9ecf5e4ef1b4980e38760cd13965fe10038add` | `4a20fa00c24396e6fef884c94be9bc0d45e70fec01c10d860f868c4213c1efa0` | `52091e45d6aa93be2fe575284331f0eb7e7d3782826ec11aaca5feb6cb76d502` Configurable etcd quota backend bytes in GCE (, ) Cluster Autoscaler 1.0.4 (, ) Prevent kubelet from getting wedged if initialization of modules returns an error. (, ) Updates Calico version to

(Fixed a bug where Felix would crash when parsing a NetworkPolicy with a named port. See https://github.com/projectcalico/calico/releases/tag/v2.6.7) (, ) Configurable etcd compaction frequency in GCE (, ) , ) Updated priority of mirror pod according to PriorityClassName. (, ) Fix kubelet to correctly umounts mount points for glusterfs when transport endpoint is not connected and nfs when there is a stale file handle (, ) Detach and clear bad disk URI (, ) Expose Metrics Server metrics via /metric endpoint. (, ) Access to externally managed IP addresses via the kube-apiserver service proxy subresource is no longer allowed by default. This can be re-enabled via the `ServiceProxyAllowExternalIPs` feature gate, but will be disallowed completely in 1.11 (, ) Add apiserver metric for number of requests dropped because of inflight limit. (, ) Add apiserver metric for current inflight-request usage. (, ) Update Calico version to v2.6.6 (, ) Correctly handle transient connection reset errors on GET requests from client library. (, ) Fixes an issue where the resourceVersion of an object in a DELETE watch event was not the resourceVersion of the delete itself, but of the last update to the object. This could disrupt the ability of clients clients to re-establish watches properly. (, ) Fix a bug affecting nested data volumes such as secret, configmap, etc. (, ) Fix garbage collection and resource quota when the controller-manager uses --leader-elect=false (, ) Fixed encryption key and encryption provider rotation (, ) & filename | sha256 hash -- | -- | `39389e6bc459e96af44dbca38697a14fa292a66e5d5b82cced2ed5cd321b3793` | `9b9ecc3a6f4b5681038742744e70d1a89ce6fb829106118710df93ff9a69558b` filename | sha256 hash -- | -- | `4f5517d5c1a13921f818e76e7d9639744d166d9289196465f6811bfd6bebb7ee` | `608a5a88fed518a378f4f30b2bb1743def2366eb99b11825123f9c6ec8117f5e` | `e4e13b177f313050a68f17793eaf314c53501f7b5225aaa6a5da516ac46b6726` | `b5bd43f15fb091959fd6b4cff739b24da3194d26ed598d512adbd4b59d6a0eaa` | `0856ad62860ecedc327cb5162617c4cd3af3f40cd8308fccf0491259da5e5199` | `8c5afcb917fff4c9e927609580cb211d7daa6b7c40b2e4d67766df65b47c9883` | `3380e8a50330efa8e626c65ccc5dadcd79c6acacfadb00bb0845271eaf6091b1` | `1ba97be9f269579c2b004a898036a4d4acb7f12455c1bf43d6ab4cd7cb6e1718` | `1c7718117647e0940e007e1383b20ca438068fc74e42eb017529c6e7ec0c5bfa` | `a962223bd349b58f85e86b91d559a3a55ffa48c17322ccc3cf35cf215b5f8633` filename | sha256 hash -- | -- | `ea3df45a3cd573ba7d1a6d7fcddaf9a2812243560d591f7ba6a497f0467b18b8` | `8e4a67569e4182ffe623419b9a16d078f3a3f48f592993e83f25cc08fefd4b3d` | `1fca5b099a180a733cad9a382604d69b9b1a63a4b2bbd40e32d54871f3f06489` | `9233ed62830b505abebf6d0c120a9aa1a3eb1fe70cd7750d60552ca9ec0e4f7d` | `2ec3385847af78e66b18b1fcf9de7c75c4af26f44c07dfbb37d5d793578a7595` filename | sha256 hash -- | -- | `79ee543a9c2636f1491715739c3c54cb70ae5b215fe5ce3345e6ff92759ace72` | `60c40066bd1b9a6996371a47d1113a7ef30295e9ea37f738cd7ce86cda380516` | `92ee26c0bbb0d016122c38831903ee82d83c33b289463b9f4dc3481e5c096f9c` | `965ddb5e7c54975aa5ce35507317f9738db34f799c67e4fc625e150aac7f5c38` | `5e71d983830ab11aff065fe872bea9e9cfc663d62cd9480b4085a2d1bbf8ca95` | `6f364309fd9dc34f7c7bc13d279499fd7c434ce5cfab379f0e9848e5fab497e0` fix device name change issue for azure disk: add remount logic (, ) GCE: Allows existing internal load balancers to continue using an outdated subnetwork (, ) fix azure disk not available issue when device name changed (, ) Allow kubernetes components to react to SIGTERM signal and shutdown gracefully. (, ) fix incorrect error info when creating an azure file PVC failed (, ) GCE: Fixes ILB creation on automatic networks with manually created subnetworks. (, ) Configurable liveness probe initial delays for etcd and kube-apiserver in GCE (, ) Fixes a bug where if an error was returned that was not an `autorest.DetailedError` we would return `"not found", nil` which caused nodes to go to `NotReady` state. (, ) & filename | sha256 hash -- | -- | `8289c42b5d6da1dbf910585fca3a9d909195e540cc81bace61ec1d06b2366c1b` | `8a9d5d890c44137527fe3976d71d4f7cb18db21ba34262ce587cd979a88bb2fe` filename | sha256 hash -- | -- | `0e282477bfed6b534f2fbbd125e6e3e065bf72d15ac3532acef405e6717d8fb7` | `767c7bfbc6c1d01120e11726b9e33e184d32294e07c69a299b229329c5b98eba` | `088b40c343fecb83b514bf9af0ad1c359c98ae7aa3b62d2a078c1363f50901c9` | `47541706e4d27da55d32372344d7a4038ed389ba0be1e6fe15c651c574aac97a` | `4be0b7a01c28c1f85d4f01f86def03dd3d49ef88cb43bf7be641d9d16b6aabc2` | `2d70384262cbdfb0958542bc5a71d926c49557fc8cc3000a2592571a945ad119` | `c3be3a125ac77aa809da3495ad38456059a89cccfdfad0babaf95896fb958adc` | `2b9831c2dd65c9669b335e3623e6a7001173b9ddf203f52f37b350659d9f1102` | `9d14a96372cdcecbbb28717aff305fcd68beb540066a27f1b5e84e208a25405f` | `0fbe358ff305188fe00793284e22c9c5b2ec0e0213882f0bfe0e4bf9685075f0` filename | sha256 hash -- | -- | `9c8ff48343e5314638965407358d1e91d510c72a1c7dd7cde0c3be12790fdb98` | `dd35c1b7572ab383eb2ff60f3b039053afa124836db6d044ab14afdafbe5ca74` | `5f4637d309eb47f4f97db8d2978b0b37b271339feb5952b216a9d09ad7e67c32` | `6d3ea43edd53253e9e3b9ceb49e61b6d2c093e55be35f7b1a8f798cde842a562` | `dfe89b91399977cee291d57b446625f01cf76ebecce696e2e889863bd3c8d3b1` filename | sha256 hash -- | -- | `f8f3e7bb07db540f4b88fa5818c46efb918e795e5e89e389b9048f2f7f37674d` | `1754b8a20d9176317fea3b77b5c48ad5565b922820adcbca4017bf210168dc6e` | `0a8255effff1d5b3ad7c84c3d6f6b8cfb5beb71606bfedaef0bb45f170b806d6` | `fef465c9f66eda35479e152619b6c91e2432e92736646a898c5917098a10a1b4` | `ff024e59d52afdee003f11c65f7de428915f7e28f9b8be4b3ebf117422ae5d67` | `19a673b714c02322c544ec3a972e011410b69a7aed016ecf7ba09eccb175a1de` change default azure file/dir mode to 0755 (, ) Retry 'connection refused' errors when setting up clusters on

(, ) enable flexvolume on Windows node (, ) Add prometheus metrics for the PodSecurityPolicy admission controller (, ) fix CreateVolume func: use search mode instead (, ) remove time waiting after create storage account (save 25s) (, ) Add pvc as part of equivalence hash (, ) fix azure disk storage account init issue (, ) falls back to parse Docker runtime version as generic if not semver (, ) BUG FIX: Check both name and ports for azure health probes (, ) & filename | sha256 hash -- | -- | `7a7993e5dee72ede890e180112959a1fe179b592178ef24d04c48212c09345b8` | `358de791b2bfd85a9b76ee42629dd8d07ae46710ad2bd5a37a20136ec3c7cea8` filename | sha256 hash -- | -- | `89b57f6eccc02c95c4de4db189092756a9bf85033200a11db56ff30a38e2dda0` | `a02bbbfe403db81f7a6317e752d9fe7853b583e34077eebfa05c7f0ec4a89712` | `a1c047cdfbcb753a8beabcf6358863c125d46e71c4d3cbe56f06237ce6f2fed6` | `c32b6f90f1e8a15451f0d412d6d1f3db28948d2f7d76d4e28d83c11e1eb25f20` | `a89a5f2889e0aae0caa673a2664c7af40e488a55ae26ab7a55599b0fbd87e281` | `5b485bbac15b8621be7ff936a5f02565511b9b00e56a5b67dfa1b273586d5af1` | `ae4e8fcd230198bc3ad1294d61e04602a6bdd3c836997d48fd3262ab24e2885c` | `c7803f0e3480dfdeedd8afd2d460ab6badf0e8879febafa30a4a3fbc87554507` | `b78e04b0bc400f3f7a012cef630fd3757c12d54f16b180470d722c4d678867e1` | `a0b32d3fcd5e692a452d2a38a6dd34a7f3e40e22e88e4cfba77ae224e07d8565` filename | sha256 hash -- | -- | `523f747f68842000ca88c84e8db07243248f6064295701b2168c64d2b77adfcb` | `3e43fccbe224ae7b20fd462f9c5932e5c5d58f0a3d6f67365a9e0d4e00fa796a` | `678c92b8b7b0616d102f9b74c9a11dd2763ba67bfa30075aca964aead2fe5370` | `55993ca6301988412876b79216442968834847a571b6423235a0c7bffe65a56a` | `32cb7484cdbeb4153fc672373055a4e8a05a61f83c722bef623f3c6922c01faa` filename | sha256 hash -- | -- | `a3ae45d389001788401c07c5b3d14a9f0af842466080a3c31b6a03200b27231b` | `642bd5c1c2728463667b1e0e6a110e2bf732972c16e8900701320a7fe85ead89` | `5b654c6fad642739f949be245eae94455fd9f2a25a388ca8effb01c49bd3451e` | `3eeec484d7ea6caf1a3f8157d2fe504c411f27ee9930d744a017adefae191786` | `5874957a48d103e9dd9c1bdbecced59d13bc3ac59d2dec44de989521f711c842` | `46a57f13bc5a4b78cd58b9914257aff15163cee24f3e43bf6c3a0a87ae3ed030` Fix scheduler cache panic when updating pod conditions. (, ) Add new Prometheus metric that monitors the remaining lifetime of certificates used to authenticate requests to the API server. (, ) scheduler: Fix issue were a new pod with affinity gets stuck at `creating` because the node had been deleted but the pod still exists. (, ) Updated Dashboard add-on to version 1.8.0: The Dashboard add-on now deploys with https enabled. The Dashboard can be accessed via kubectl proxy at http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/. The /ui redirect is deprecated and will be removed in 1.10. (, ) Fix issue where masquerade rules are flushed in GCE k8s clusters. (, ) kubelet: Fix bug where `runAsUser: MustRunAsNonRoot` strategy didn't reject a pod with a non-numeric `USER`. (, ) Add iptables rules to allow Pod traffic even when default iptables policy is to reject. (, ) Fix a bug in GCE multizonal clusters where PersistentVolumes were sometimes created in zones without nodes. (, ) If a non-absolute mountPath is passed to the kubelet, prefix it with the appropriate root path. (, ) add GRS, RAGRS storage account type support for azure disk (, ) Fix a typo in prometheus-to-sd configuration, that drops some stackdriver metrics. (, ) Fixes server name verification of aggregated API servers and webhook admission endpoints (, ) Update jquery and bootstrap dependencies (, ) Fix CRI localhost seccomp path in format localhost//profileRoot/profileName. (, ) support mount options in azure file (, ) kube-apiserver: fixed --oidc-username-prefix and --oidc-group-prefix flags which previously weren't correctly enabled (, ) fluentd-gcp addon: Fix fluentd deployment on GCP when custom resources are set. (, ) API discovery failures no longer crash the kube controller manager via the garbage collector. (, ) Fix bug where master startup script on GCP failed randomly due to concurrent iptables invocations. (, ) & filename | sha256 hash -- | -- | `7f87cdafaf5959dfd60e4a89203a7e85cc139262b87c491e3ef46a1313fb9379` | `084a6d95c17c0c06123c146f04501eb8cbf23bfcbcfa23d511a0a2d2018c4a93` filename | sha256 hash -- | -- | `86b1ac96cd3bbaaa25806f8de34c26a9d6c9ba1daf70baa9df9d488db0da7054` | `f541a9b48ef115e2e4923f906daa9bc112f0b308d8d5559135e507d04fdc0424` | `9d3ea12e58e2e6eef35641856a5fa116bd7301570868252c5525ff8a0719b5bc` | `4d3c2a9e0d837e3607580d95bbc473ffb496fc47ba0ce7721e9180a9020f1f39` | `02c95d433cc5ce4f2d1e162b13f74f82888cd6dbd91c031198fbb7ab55131093` | `8f3d6bf3a3e05a65c93e071ce6b5653be534aa358c01cc2de704db9bc45b040e` | `775bcc7d66364f43794be96ab6b36992904f7ed0d56bb8e309216be23ff22862` | `162584246b70c2a3c40571080c1cf0c73efbe6101d7c7f27059115336b901cb8` | `fd88cc783cd73972b9175bebdb719dff697b5ff200ea6ef61152f3ce38b07f6f` | `42ec653406de971f7a7e5b16c5ef0d6ebf3d17782d40b2a88a13ef128fe57d62` filename | sha256 hash -- | -- | `08d64a59a5fe620488f05214844a910144d7fe16a783d351704c71f3843124dc` | `75ef62ecd203088a0f5bb5f48d782fd91af4a7dc3348b265ddd13c5bd15d0d01` | `276120cdc40e7925c4c09e26a546d954a43d0599b573e26b76f62f816b5b256d` | `2c9a213de651be74452116778dc47800f036d03cdbdf65a424a3fd566906933d` | `7c073fe63198b793b7a63ebd5f8adb69b780cae128df70b2c964f2493487021f` filename | sha256 hash -- | -- | `108e9cb2353aa64bbf5e11b938ee65a79abd879136b1f4ab123c897463d388fb` | `b59029a6abbfb628bb14d1d2b633307ad1f22c6b758ffd11d7ba5b1a82e63f94` | `f31b08171d6a07ae4fca6b0153ce8da68df766f2334dc75c8b3206840c22424e` | `0065e1b5cf385097b8da29cc2c91c5555e5f3cd8beed1874f1753b9b5c10e363` | `dd08355d5350ef7f881f109bbe627071b494f3d86633a29ac2e4a834cd8d70b3` | `1b11e3fbc0af816510660a624f38a68c8c1008c1d9045a4bad373be8af022f7a` Cluster Autoscaler 1.0.3 (, ) - Add PodSecurityPolicies for cluster addons (, ) - Remove SSL cert HostPath volumes from heapster addons Fix session affinity issue with external load balancer traffic when ExternalTrafficPolicy=Local. (, ) Addon manager supports HA masters. (, ) ScaleIO persistent volumes now support referencing a secret in a namespace other than the bound persistent volume claim's namespace; this is controlled during provisioning with the `secretNamespace` storage class parameter; StoragePool and ProtectionDomain attributes no longer defaults to the value `default` (, ) Allow HPA to read custom

(, ) Add masquerading rules by default to GCE/GKE (, ) kubeadm now produces error during preflight checks if swap is enabled. Users, who can setup kubelet to run in unsupported environment with enabled swap, will be able to skip that preflight check. (, ) GCE: provide an option to disable docker's live-restore on COS/ubuntu (, ) Fix hyperkube kubelet --experimental-dockershim (, ) ScaleIO driver completely removes dependency on drv_cfg binary so a Kubernetes cluster can easily run a containerized kubelet. (, ) & filename | sha256 hash -- | -- | `86a565d47afb2b4440a3d706e24b9590225e576f1aee1d0117f6a82c13a7ca1a` | `3fa0d5f87f92004297f17ed9791a9c309c6ed6958bbd4df6e3de5da640d35c25` filename | sha256 hash -- | -- | `e85d9804e14c0acc3f9e71a03e0ea10fc4848c94bb0fed56776d8137b71f70d7` | `2095e610c6b838a51ef054175794a9fe2436b02c1c4f36dfe4ac7b6ea77a59e5` | `970764b73734809daf11337ced1f71708a8be15573fa6c68dcf2a12b70820640` | `8796ce36f2f59e34e9bd7e788bc23076ccc8371a79535443b6105a9aae544c2a` | `94a5ce6fea8ce9d3e3b726f79820d3c85d87322687ff9b97f5bbc0d28f41816b` | `6ff7bdabf7a5ff01d9f0d03d991c9dcd11503cf5c7b1ead5a9103ebf6f6dc2a1` | `000b8c1138e3074d6880bf3eb0b2ed5c6db8c6fba4792dba720c489cf2f82b58` | `c77de362e41606c2fa7757cdf47c95e0dce6dc448017a8b9550f7bab9eb52cca` | `3a7561fb0e90add10b286e738ec369987a1bc4750ccf05d00dc0e4fd735b86e1` | `0e1bc781f607cf580696b929a9e40805701ebf25f8b166ec7687de46eb417011` filename | sha256 hash -- | -- | `557c231a63f5975d08565dd690381bd63d9db14528da07c7e86305a82fbd9c8b` | `b1c2cbe6a308df51815c98f93a1ec5e8e5be390ae1e4c31ab7c03c581e8442f2` | `db5cb69166b482bc705f56a4b50fbe1c553dcbcf83c569bef2828ec70c94fa36` | `aca313f74aa682e9ced1b3f238fd6b03795d6a2f12a6604481fafe9756f88c82` | `42e7cc141555ffa7a7653de5065715164817c7b096d13b58b7770a6b66283b39` filename | sha256 hash -- | -- | `6035027a39fd8cac6de9f33efcb929300798a5601b0c2ca0569baaf18ce12559` | `495ebf4885af7896cf28fbd6988bd954d576bee99ba815e6e741a0c407bae92a` | `d1c0595f086a1a2c9c73ee556750db3e7485c3e75f9496214313f935ad6d0350` | `2b036ca22970d9dcb6b80da45f3ecaeb6b1e78b4474718a8581d2f987779c3fa` | `f936cbfe0f2888a25620c8fe21b297459dd235044f1587f02456921be458d5ff` | `b913fb8267c545db77c0c43234c773043031c7564cc745e61842f58277041c58` Fixed 'Schedulercache is corrupted' error in kube-scheduler (, ) Add support for PodSecurityPolicy on GCE: `ENABLEPODSECURITY_POLICY=true` enables the admission controller, and installs policies for default addons. (, ) Azure cloudprovider: Fix controller manager crash issue on a manually created k8s cluster. (, ) Cluster Autoscaler 1.0.2 (, ) - fluentd-gcp runs with a dedicated fluentd-gcp service account (, ) - Stop mounting the host certificates into fluentd's prometheus-to-sd container Fix a bug where pod address is not removed from endpoints object while pod is in graceful termination. (, ) fix warning messages due to GetMountRefs func not implemented in windows (, ) allow windows mount path (, ) Reduce log noise produced by prometheus-to-sd, by bumping it to version 0.2.2. (, ) Fix clustered datastore name to be absolute. (, ) Fix `kubeadm upgrade plan` for offline operation: ignore errors when trying to fetch latest versions from dl.k8s.io (, ) Add openssh-client back into the hyperkube image. This allows the gitRepo volume plugin to work properly. (, ) Fix an issue where pods were briefly transitioned to a "Pending" state during the deletion process. (, ) Add a label which prevents a node from being added to a cloud load balancer (, ) Add a new feature gate for enabling an alpha annotation which, if present, excludes the annotated node from being added to a service load balancers. (, ) Support German cloud for azure disk mount feature (, ) Fix overlay2 container disk metrics for Docker and CRI-O (, ) API machinery's httpstream/spdy calls now support CIDR notation for NO_PROXY (, ) fix a bug where disk pressure could trigger prematurely when using overlay2 (, ) PodSecurityPolicy: when multiple policies allow a submitted pod, priority is given to ones which do not require any fields in the pod spec to be defaulted. If the pod must be defaulted, the first policy (ordered by name) that allows the pod is used. (, ) Fixes discovery information for scale subresources in the apps API group (, ) BugFix: Exited containers are not Garbage Collected by the kubelet while the pod is running (, ) fix azure pv crash due to volumeSource.ReadOnly value nil (, ) kubeadm init: fix a bug that prevented the --token-ttl flag and tokenTTL configuration value from working as expected for infinite (0) values. (, ) , ) fix azure disk mount failure on coreos and some other distros (, ) Fix for service controller so that it won't retry on doNotRetry service update

(, ) BulkVerifyVolumes() implementation for vSphere (, ) Added option lb-provider to OpenStack cloud provider config (, ) & filename | sha256 hash -- | -- | `06a800c414e776640a7861baa4f0b6edbd898c13ad3ebcd33860fe5d949bbdee` | `fbfb65a4eb1ddff32e302a0821204fa780ebb5b27298e31699c43c19da48191e` filename | sha256 hash -- | -- | `3eb81f1178ff73ca683738606acea1d9537a33c6e3d15571795a24af6c53dbd7` | `15da279f018a73f93b857639931c4ba8a714c86e5c5738c33840c47df44ac2a4` | `bd9f144e6ddfc715fa77d9cb0310763e49f8121e894ed33714658fb2d6eb2675` | `7c20d4a3859c07aadf9a1676876bafdf56187478a69d3bfca5277fb275febb96` | `395c3fb5992509191cacbaf6e7ed4fd0fbee5c0b9c890f496879784454f88aa3` | `a1cff2f8ab5f77f000e20f87b00a3723a8323fec82926afcc984722ab3f8d714` | `832a1e399802bfd8871cd911f17dbb6b2264680e9477c2944d442a3f9e5fa6f2` | `6afc2c4a331ee70e095a6d1e1f11bf69923afb1830840d110459e32b849b1b6c` | `ecaadb5a4c08357685dbaee288d1220bd60ff0f86281ec88a5467da6eebf213b` | `b8ff337615f740b1501cf7284d7f0a51a82880dcf23fff2464f8d37045c27f3f` filename | sha256 hash -- | -- | `8ccd4912473e0d334694434936a5ca9547caddaa39d771a1fb94620c5d6002d4` | `39b3c61927c905f142d74fe69391156e6bf61cc5e7a798cdf2c295a76e72161d` | `fc6b01b233f8d0c61dd485d8d571c9a2e1a5b085f0d0db734a84c42b71416537` | `6f6d8dcef0334736021d9f6cc2bbfdb78500483f8961e7ff14b09f1c67d37056` | `6f1b6b5fb818fdb787cdf65ff3da81235b5b4db5b4a9b5579920d11dc8a3fa73` filename | sha256 hash -- | -- | `93c6b5d2a5e4aaf8776f56e5b8f40038c76d3d03709124fb8900f83acb49c782` | `ab4535e19825e0e9b76987dbb11d9fd746281e45a90f90b453dbc7d6fecb2c69` | `96acd6ec41d4a3ec7ea6f95acecf116755340915e3d261de760d9ed84708e3f0` | `4256a8c315de083435fcdfc8ee2ae370bd603fa976218edadbf7bfe11adcf223` | `30f2254bf442fc36fc23bd962930eb48fd000c9ffce81c26c0d64d4a0fd0c193` | `b92c2670ce8dd75f744537abb6e98df84ce5a18da7df6b70741e92d9e57098bf` Allow for configuring etcd hostname in the manifest (, ) Allow standard flags in client-gen. (, ) Cluster Autoscaler 1.0.1 (, ) Resolves forbidden error when accessing replicasets and daemonsets via the apps API group (, ) kubelet: prevent removal of default labels from Node API objects on startup (, ) Fix a bug that prevents client-go metrics from being registered in prometheus in multiple components. (, ) Webhook always retries connection reset error. (, ) Adjust batching audit webhook default parameters: increase queue size, batch size, and initial backoff. Add throttling to the batching audit webhook. Default rate limit is 10 QPS. (, ) Address a bug which allowed the horizontal pod autoscaler to allocate `desiredReplicas` > `maxReplicas` in certain instances. (, ) Fix metrics API group name in audit configuration (, ) Use separate client for leader election in scheduler to avoid starving leader election by regular scheduler operations. (, ) kubeadm: Strip bootstrap tokens from the `kubeadm-config` ConfigMap (, ) & filename | sha256 hash -- | -- | `15bf424a40544d2ff02eeba00d92a67409a31d2139c78b152b7c57a8555a1549` | `b2084cefd774b4b0ac032d80e97db056fcafc2d7549f5a396dc3a3739f2d7a0b` filename | sha256 hash -- | -- | `78dfcdc6f2c1e144bcce700b2aa179db29150b74f54335b4f5e36f929e56ee4b` | `bce8609e99ed8f0c4ccd8e9b275b8140030fee531fab6f01a755d563442240b4` | `13beeea6846b19648fc09ffe345bca32ea52e041e321b787e243e9b35b2c1b83` | `d7341402fe06f08e757f901674d2fb43d75161ac53bf2f41a875668e5ac2dad0` | `aab4505e13f12a5cadbdb3980e5f8a5144b410c3d04bb74b8f25d2680908fb5c` | `aec3a3eeb64f22055acf6b16e82449435786f2bd578feb11847d53414c40c305` | `72660598408b03ec428b3ba389c96ad6e2f3a036c7059d3760d34722ed0654fb` | `5a02d0eb9987b0a32f22a82aa12a13e8f9fd8504d2339017f17881c48817ddfb` | `2fda2cfe470254a1c109d7311f33fb6566f41bd34ec25f49b6c28802eecfb831` | `2a7403be3bdcffd8907f59b144dca0378c0ffc014fd60282924e83ea743d0017` filename | sha256 hash -- | -- | `8c7fc5b99be7dc6736bea5cabe06ef2c60765df1394cd1707e49a3eb8b8a3c8d` | `812fbc06ca1df8c926b29891346c5737677a75b644591697a536c8d1aa834b2e` | `cc612f34b9d95ae49b02e1e772ff26b518a1e157c10e6147a13bafa4710b3768` | `3ba0a6c6241fc70055acffbd16835c335f702ebf27d596e8b1d6e9cf7cd8d8f8` | `cd0a731663b0f95cdaefcd54166ecf917cc2ddb470a3ed96f16f0cae9604f969` filename | sha256 hash -- | -- | `4fccb39e01fb6f2e9120a03b3600d85079138086d8b39bdfb410b2738e6c17c4` | `8b7578c1b39d2f525e28afbc56701b69d0c0d0b3b361d6c28740b40ffbeb7ffa` | `71eac41487d6226beb654c3a2fb49bb8f08ba38d6c844bb6588528325ba2ede9` | `5ebece4e189257ba95d1b39c7d1b00fb4d0989a806aa2b76eb42f9a6300c4695` | `a0a6658ee44d0e92c0f734c465e11262de6a6920d283e999e5b7ed5bab865403` | `3381d308aef709ccaf2c9357ac2a0166d918ba06dc1128b20736df9667284599` PodSecurityPolicy: Fixes a compatibility issue that caused policies that previously allowed privileged pods to start forbidding them, due to an incorrect default value for `allowPrivilegeEscalation`. PodSecurityPolicy objects defined using a 1.8.0 client or server that intended to set `allowPrivilegeEscalation` to `false` must be reapplied after upgrading to 1.8.1. (, ) Fix to prevent downward api change break on older versions (, ) Ignore extended resources that are not registered with kubelet during container resource allocation. (, ) GCE: Bump GLBC version to . (, ) kubeadm 1.8 now properly handles upgrades from to 1.7.x to newer release in 1.7 branch (, ) Add generate-groups.sh and generate-internal-groups.sh to k8s.io/code-generator to easily run generators against CRD or User API Server types. (, ) Don't remove extended resource capacities that are not registered with kubelet from node status. (, ) kubeadm allows the kubelets in the cluster to automatically renew their client certificates (, ) Bumped Heapster version to 1.4.3 - more details https://github.com/kubernetes/heapster/releases/tag/v1.4.3. (, ) Change `kubeadm create token` to default to the group that almost everyone will want to use. The group is system:bootstrappers:kubeadm:default-node-token and is the group that kubeadm sets up, via an RBAC binding, for auto-approval (system:certificates.k8s.io:certificatesigningrequests:nodeclient). (, ) GCE: Fix issue deleting internal load balancers when the firewall resource may not exist. (, ) GCE: Fixes ILB sync on legacy networks and auto networks with unique subnet names (, ) Fix the bug that query Kubelet's stats summary with CRI stats enabled results in error. (, ) kubelet `--cert-dir` now defaults to `/var/lib/kubelet/pki`, in order to ensure bootstrapped and rotated certificates persist beyond a

resolves an issue in kubeadm with false-positive `/var/lib/kubelet is not empty` message during pre-flight checks (, ) Fix permissions for Metrics Server. (, ) Fixes a performance issue () identified in large-scale clusters when deleting thousands of pods simultaneously across hundreds of nodes, by actively removing containers of deleted pods, rather than waiting for periodic garbage collection and batching resulting pod API deletion requests. (, ) Fixes an issue with RBAC reconciliation that could cause duplicated subjects in some bootstrapped rolebindings on each restart of the API server. (, ) Change ImageGCManage to consume ImageFS stats from StatsProvider (, ) Fixes an issue with `kubectl set` commands encountering conversion errors for ReplicaSet and DaemonSet objects (, ) & filename | sha256 hash -- | -- | `802a2bc9e9da6d146c71cc446a5faf9304de47996e86134270c725e6440cbb7d` | `0ea97d20a2d47d9c5f8e791f63bee7e27f836e1a19cf0f15f39e726ae69906a0` filename | sha256 hash -- | -- | `22d82ec72e336700562f537b2e0250eb2700391f9b85b12dfc9a4c61428f1db1` | `de86af6d5b6da9680e93c3d65d889a8ccb59a3a701f3e4ca7a810ffd85ed5eda` | `4fef05d4b392c2df9f8ffb33e66ee5415671258100c0180f2e1c0befc37a2ac3` | `bef36b2cdcf66a14aa7fc2354c692fb649dc0521d2a76cd3ebde6ca4cb6bad09` | `4cfd3057db15d1e9e5cabccec3771e1efa37f9d7acb47e90d42fece86daff608` | `29d9a5faf6a8a1a911fe675e10b8df665f6b82e8f3ee75ca901062f7a3af43ec` | `f467c37c75ba5b7125bc2f831efe3776e2a85eeb7245c11aa8accc26cf14585b` | `e0de490b6ce67abf1b158a57c103098ed974a594c677019032fce3d1c9825138` | `02ea1cd79b591dbc313fab3d22a985219d46f939d79ecc3106fb21d0cb1422cb` | `8ca1f609d1cf5ec6afb330cfb87d33d20af152324bed60fe4d91995328a257ff` filename | sha256 hash -- | -- | `23422a7f11c3eab59d686a52abae1bce2f9e2a0916f98ed05c10591ba9c3cbad` | `17a1e99010ae3a38f1aec7b3a09661521aba6c93a2e6dd54a3e0534e7d2fafe4` | `3aba33a9d06068dbf40418205fb8cb62e2987106093d0c65d99cbdf130e163ee` | `84192c0d520559dfc257f3823f7bf196928b993619a92a27d36f19d2ef209706` | `246da14c49c21f50c5bc0d6fc78c023f71ccb07a83e224fd3e40d62c4d1a09d0` filename | sha256 hash -- | -- | `59589cdd56f14b8e879c1854f98072e5ae7ab36835520179fca4887fa9b705e5` | `99d17807a819dd3d2764c2105f8bc90166126451dc38869b652e9c59be85dc39` | `53b1fa21ba4172bfdad677e60360be3e3f28b26656e83d4b63b038d8a31f3cf0` | `9d10e2d1417fa6c18c152a5ac0202191bf27aab49e473926707c7de479112f46` | `cb4e8e9b00484e3f96307e56c61107329fbfcf6eba8362a971053439f64b0304` | `6ca4af62b53947d854562f5a51f4a02daa4738b68015608a599ae416887ffce8` Kubernetes version 1.8 includes new features and enhancements, as well as fixes to identified issues. The release notes contain a brief overview of the important changes introduced in this release. The content is organized by Special Interest Groups (). For initial installations, see the in the Kubernetes documentation. To upgrade to this release from a previous version, take any actions required . For more information about the release and for the latest documentation, see the. Kubernetes is developed by community members whose work is organized into . For the 1.8 release, each SIG provides the themes that guided their work. is responsible for all aspects of the API server: API registration and discovery, generic API CRUD semantics, admission control, encoding/decoding, conversion, defaulting, persistence layer (etcd), OpenAPI, third-party resources, garbage collection, and client libraries. For the 1.8 release, SIG API Machinery focused on stability and on ecosystem enablement. Features include the ability to break large LIST calls into smaller chunks, improved support for API server customization with either custom API servers or Custom Resource Definitions, and client side event spam filtering. focuses on the Kubernetes APIs and the external tools that are required to deploy and operate Kubernetes workloads. For the 1.8 release, SIG Apps moved the Kubernetes workloads API to the new apps/v1beta2 group and version. The DaemonSet, Deployment, ReplicaSet, and StatefulSet objects are affected by this change. The new apps/v1beta2 group and version provide a stable and consistent API surface for building applications in Kubernetes. For details about deprecations and behavioral changes, see . SIG Apps intends to promote this version to GA in a future release. is responsible for Kubernetes authentication and authorization, and for cluster security policies. For the 1.8 release, SIG Auth focused on stablizing existing features that were introduced in previous releases. RBAC was moved from beta to v1, and advanced auditing was moved from alpha to beta. Encryption of resources stored on disk (resources at rest) remained in alpha, and the SIG began exploring integrations with external key management systems. is responsible for autoscaling-related components, such as the Horizontal Pod Autoscaler and Cluster Autoscaler. For the 1.8 release, SIG Autoscaling continued to focus on stabilizing features introduced in previous releases: the new version of the Horizontal Pod Autoscaler API, which supports custom metrics, and the Cluster Autoscaler, which provides improved performance and error

is responsible for the user experience of deploying, upgrading, and deleting clusters. For the 1.8 release, SIG Cluster Lifecycle continued to focus on expanding the capabilities of kubeadm, which is both a user-facing tool to manage clusters and a building block for higher-level provisioning systems. Starting with the 1.8 release, kubeadm supports a new upgrade command and includes alpha support for self hosting the cluster control plane. is responsible for metrics production and collection. For the 1.8 release, SIG Instrumentation focused on stabilizing the APIs and components that are required to support the new version of the Horizontal Pod Autoscaler API: the resource metrics API, custom metrics API, and metrics-server, which is the new replacement for Heapster in the default monitoring pipeline. is responsible for infrastructure that supports the efficient and reliable management of multiple Kubernetes clusters, and applications that run in and across multiple clusters. For the 1.8 release, SIG Multicluster focussed on expanding the set of Kubernetes primitives that our Cluster Federation control plane supports, expanding the number of approaches taken to multi-cluster management (beyond our initial Federation approach), and preparing to release Federation for general availability ('GA'). is responsible for the components that support the controlled interactions between pods and host resources, and manage the lifecycle of pods scheduled on a node. For the 1.8 release, SIG Node continued to focus on a broad set of workload types, including hardware and performance sensitive workloads such as data analytics and deep learning. The SIG also delivered incremental improvements to node reliability. is responsible for networking components, APIs, and plugins in Kubernetes. For the 1.8 release, SIG Network enhanced the NetworkPolicy API to support pod egress traffic policies. The SIG also provided match criteria that allow policy rules to match a source or destination CIDR. Both features are in beta. SIG Network also improved the kube-proxy to include an alpha IPVS mode in addition to the current iptables and userspace modes. is responsible for scalability testing, measuring and improving system performance, and answering questions related to scalability. For the 1.8 release, SIG Scalability focused on automating large cluster scalability testing in a continuous integration (CI) environment. The SIG defined a concrete process for scalability testing, created documentation for the current scalability thresholds, and defined a new set of Service Level Indicators (SLIs) and Service Level Objectives (SLOs) for the system. Here's the release [scalability validation report]. is responsible for generic scheduler and scheduling components. For the 1.8 release, SIG Scheduling extended the concept of cluster sharing by introducing pod priority and pod preemption. These features allow mixing various types of workloads in a single cluster, and help reach higher levels of resource utilization and availability. These features are in alpha. SIG Scheduling also improved the internal APIs for scheduling and made them easier for other components and external schedulers to use. is responsible for storage and volume plugin components. For the 1.8 release, SIG Storage extended the Kubernetes storage API. In addition to providing simple volume availability, the API now enables volume resizing and snapshotting. These features are in alpha. The SIG also focused on providing more control over storage: the ability to set requests and limits on ephemeral storage, the ability to specify mount options, more metrics, and improvements to Flex driver deployments. Consider the following changes, limitations, and guidelines before you upgrade: The kubelet now fails if swap is enabled on a node. To override the default and run with /proc/swaps on, set `--fail-swap-on=false`. The experimental flag `--experimental-fail-swap-on` is deprecated in this release, and will be removed in a future

The `autoscaling/v2alpha1` API is now at `autoscaling/v2beta1`. However, the form of the API remains unchanged. Migrate the `HorizontalPodAutoscaler` resources to `autoscaling/v2beta1` to persist the `HorizontalPodAutoscaler` changes introduced in `autoscaling/v2alpha1`. The Horizontal Pod Autoscaler changes include support for status conditions, and autoscaling on memory and custom metrics. The metrics APIs, `custom-metrics.metrics.k8s.io` and `metrics`, were moved from `v1alpha1` to `v1beta1`, and renamed to `custom.metrics.k8s.io` and `metrics.k8s.io`, respectively. If you have deployed a custom metrics adapter, ensure that it supports the new API version. If you have deployed Heapster in aggregated API server mode, upgrade Heapster to support the latest API version. Advanced auditing is the default auditing mechanism at `v1beta1`. The new version introduces the following changes: The `--audit-policy-file` option is required if the `AdvancedAuditing` feature is not explicitly turned off (`--feature-gates=AdvancedAuditing=false`) on the API server. The audit log file defaults to JSON encoding when using the advanced auditing feature gate. An audit policy file without either an `apiVersion` or a `kind` field may be treated as invalid. The webhook and log file now output the `v1beta1` event format. For more details, see . The deprecated `ThirdPartyResource` (TPR) API was removed. To avoid losing your TPR data, . The following deprecated flags were removed from `kube-controller-manager`: `replication-controller-lookup-cache-size` `replicaset-lookup-cache-size` `daemonset-lookup-cache-size` Don't use these flags. Using deprecated flags causes the server to print a warning. Using a removed flag causes the server to abort the startup. The following deprecated flags were removed from `kubelet`: `api-servers` - add apiserver addresses to the kubeconfig file instead. Don't use these flags. Using deprecated flags causes the kubelet to print a warning. Using a removed flag causes the kubelet to abort the startup. StatefulSet: The deprecated `pod.alpha.kubernetes.io/initialized` annotation for interrupting the StatefulSet Pod management is now ignored. StatefulSets with this annotation set to `true` or with no value will behave just as they did in previous versions. Dormant StatefulSets with the annotation set to `false` will become active after upgrading. The CronJob object is now enabled by default at `v1beta1`. CronJob `v2alpha1` is still available, but it must be explicitly enabled. We recommend that you move any current CronJob objects to `batch/v1beta1.CronJob`. Be aware that if you specify the deprecated version, you may encounter Resource Not Found errors. These errors occur because the new controllers look for the new version during a rolling update. The `batch/v2alpha1.ScheduledJob` was removed. Migrate to `batch/v1beta.CronJob` to continue managing time based jobs. The `rbac/v1alpha1`, `settings/v1alpha1`, and `scheduling/v1alpha1` APIs are disabled by default. The `system:node` role is no longer automatically granted to the `system:nodes` group in new clusters. The role gives broad read access to resources, including secrets and configmaps. Use the `Node` authorization mode to authorize the nodes in new clusters. To continue providing the `system:node` role to the members of the `system:nodes` group, create an installation-specific `ClusterRoleBinding` in the installation. () This section contains a list of known issues reported in Kubernetes 1.8 release. The content is populated via . Kubelets using TLS bootstrapping (`--bootstrap-kubeconfig`) or certificate rotation (`--rotate-certificates`) store certificates in the directory specified by `--cert-dir`. The default location (`/var/run/kubernetes`) is automatically erased on reboot on some platforms, which can prevent the kubelet from authenticating to the API server after a reboot. Specifying a non-transient location, such as `--cert-dir=/var/lib/kubelet/pki`, is recommended. For more information, see . `kubeadm init` and `kubeadm join` invocations on newly installed systems can encounter a `/var/lib/kubelet is not empty` message during pre-flight checks that prevents setup. If this is the only pre-flight failure, it can be safely ignored with

For more information, see . A performance issue was identified in large-scale clusters when deleting thousands of pods simultaneously across hundreds of nodes. Kubelets in this scenario can encounter temporarily increased latency of `delete pod` API calls -- above the target service level objective of 1 second. If you run clusters with this usage pattern and if pod deletion latency could be an issue for you, you might want to wait until the issue is resolved before you upgrade. For more information and for updates on resolution of this issue, see . Audit logs might impact the API server performance and the latency of large request and response calls. The issue is observed under the following conditions: if `AdvancedAuditing` feature gate is enabled, which is the default case, if audit logging uses the log backend in JSON format, or if the audit policy records large API calls for requests or responses. For more information, see . Minikube version 0.22.2 or lower does not work with kubectl version 1.8 or higher. This issue is caused by the presence of an unregistered type in the minikube API server. New versions of kubectl force validate the OpenAPI schema, which is not registered with all known types in the minikube API server. For more information, see . The `ENABLEAPISERVERBASIC_AUDIT` configuration parameter for GCE deployments is broken, but deprecated. For more information, see . `kubectl set` commandsplaced on ReplicaSet and DaemonSet occasionally return version errors. All setcommands, includingset image,set env,set resources, andset serviceaccounts, are affected. For more information, see . Object quotas are not consistently charged or updated. Specifically, the object count quota does not reliably account for uninitialized objects. Some quotas are charged only when an object is initialized. Others are charged when an object is created, whether it is initialized or not. We plan to fix this issue in a future release. For more information, see . This section provides an overview of deprecated API versions, options, flags, and arguments. Deprecated means that we intend to remove the capability from a future release. After removal, the capability will no longer work. The sections are organized by SIGs. The `.spec.rollbackTo` field of the Deployment kind is deprecated in `extensions/v1beta1`. The `kubernetes.io/created-by` annotation is deprecated and will be removed in version 1.9. Use instead to determine which controller, if any, owns an object. The `batch/v2alpha1.CronJob` is deprecated in favor of `batch/v1beta1`. The `batch/v2alpha1.ScheduledJob` was removed. Use `batch/v1beta1.CronJob` instead. The RBAC v1alpha1 API group is deprecated in favor of RBAC v1. The API server flag `--experimental-bootstrap-token-auth` is deprecated in favor of `--enable-bootstrap-token-auth`. The `--experimental-bootstrap-token-auth` flag will be removed in version 1.9. Consuming metrics directly from Heapster is deprecated in favor of consuming metrics via an aggregated version of the resource metrics API. In version 1.8, enable this behavior by setting the `--horizontal-pod-autoscaler-use-rest-clients` flag to `true`. In version 1.9, this behavior will be enabled by default, and must be explicitly disabled by setting the `--horizontal-pod-autoscaler-use-rest-clients` flag to `false`. The `auto-detect` behavior of the kubelet's `--cloud-provider` flag is deprecated. In version 1.8, the default value for the kubelet's `--cloud-provider` flag is `auto-detect`. Be aware that it works only on GCE, AWS and Azure. In version 1.9, the default will be `""`, which means no built-in cloud provider extension will be enabled by default. Enable an out-of-tree cloud provider with `--cloud-provider=external` in either version. For more information on deprecating auto-detecting cloud providers in kubelet, see PR and . The `PersistentVolumeLabel` admission controller in the API server is

The replacement is running a cloud-specific controller-manager (often referred to as `cloud-controller-manager`) with the `PersistentVolumeLabel` controller enabled. This new controller loop operates as the `PersistentVolumeLabel` admission controller did in previous versions. Do not use the `PersistentVolumeLabel` admission controller in the configuration files and scripts unless you are dependent on the in-tree GCE and AWS cloud providers. The `PersistentVolumeLabel` admission controller will be removed in a future release, when the out-of-tree versions of the GCE and AWS cloud providers move to GA. The cloud providers are marked alpha in version 1.9. The `openstack-heat` provider for `kube-up` is deprecated and will be removed in a future release. Refer to Issue for background information. Opaque Integer Resources (OIRs) are deprecated and will be removed in version 1.9. Extended Resources (ERs) are a drop-in replacement for OIRs. You can use any domain name prefix outside of the `kubernetes.io/` domain instead of the `pod.alpha.kubernetes.io/opaque-int-resource-` prefix. Kubernetes 1.8 adds the apps/v1beta2 group and version, which now consists of the DaemonSet, Deployment, ReplicaSet and StatefulSet kinds. This group and version are part of the Kubernetes Workloads API. We plan to move them to v1 in an upcoming release, so you might want to plan your migration accordingly. For more information, see The DaemonSet, Deployment, ReplicaSet, and StatefulSet kinds are now in the apps/v1beta2 group and version. The apps/v1beta2 group version adds a Scale subresource for the StatefulSet kind. All kinds in the apps/v1beta2 group version add a corresponding conditions kind. For all kinds in the API group version, a spec.selector default value is no longer available, because it's incompatible with `kubectl apply` and strategic merge patch. You must explicitly set the spec.selector value in your manifest. An object with a spec.selector value that does not match the labels in its spec.template is invalid. Selector mutation is disabled for all kinds in the app/v1beta2 group version, because the controllers in the workloads API do not handle selector mutation in a consistent way. This restriction may be lifted in the future, but it is likely that that selectors will remain immutable after the move to v1. You can continue to use code that depends on mutable selectors by calling the apps/v1beta1 API in this release, but you should start planning for code that does not depend on mutable selectors. Extended Resources are fully-qualified resource names outside the `kubernetes.io` domain. Extended Resource quantities must be integers. You can specify any resource name of the form `[aaa.]my-domain.bbb/ccc` in place of . Extended resources cannot be overcommitted, so make sure that request and limit are equal if both are present in a container spec. The default Bootstrap Token created with `kubeadm init` v1.8 expires and is deleted after 24 hours by default to limit the exposure of the valuable credential. You can create a new Bootstrap Token with `kubeadm token create` or make the default token permanently valid by specifying `--token-ttl 0` to `kubeadm init`. The default token can later be deleted with `kubeadm token delete`. `kubeadm join` now delegates TLS Bootstrapping to the kubelet itself, instead of reimplementing the process. `kubeadm join` writes the bootstrap kubeconfig file to `/etc/kubernetes/bootstrap-kubelet.conf`. The default spec.updateStrategy for the StatefulSet and DaemonSet kinds is RollingUpdate for the apps/v1beta2 group version. You can explicitly set the OnDelete strategy, and no strategy auto-conversion is applied to replace default values. As mentioned in , selector defaults are disabled. The default spec.revisionHistoryLimit for all applicable kinds in the apps/v1beta2 group version is 10. In a CronJob object, the default spec.successfulJobsHistoryLimit is 3, and the default

is 1. CronJob is now at `batch/v1beta1` (, ). `batch/v2alpha.CronJob` is deprecated in favor of `batch/v1beta` and will be removed in a future release. Job can now set a failure policy using `.spec.backoffLimit`. The default value for this new field is 6. (, ). `batch/v2alpha1.ScheduledJob` is removed. The Job controller now creates pods in batches instead of all at once. (, ). Short `.spec.ActiveDeadlineSeconds` is properly applied to a Job. (, ). [alpha] `kubectl` plugins: `kubectl` now allows binary extensibility. You can extend the default set of `kubectl` commands by writing plugins that provide new subcommands. Refer to the documentation for more information. `kubectl rollout` and `rollback` now support StatefulSet. `kubectl scale` now uses the Scale subresource for kinds in the apps/v1beta2 group. `kubectl create configmap` and `kubectl create secret` subcommands now support the `--append-hash` flag, which enables unique but deterministic naming for objects generated from files, for example with `--from-file`. `kubectl run` can set a service account name in the generated pod spec with the `--serviceaccount` flag. `kubectl proxy` now correctly handles the `exec`, `attach`, and `portforward` commands. You must pass `--disable-filter` to the command to allow these commands. Added `cronjobs.batch` to "all", so that `kubectl get all` returns them. Added flag `--include-uninitialized` to `kubectl annotate`, `apply`, `edit-last-applied`, `delete`, `describe`, `edit`, `get`, `label,` and `set`. `--include-uninitialized=true` makes kubectl commands apply to uninitialized objects, which by default are ignored if the names of the objects are not provided. `--all` also makes kubectl commands apply to uninitialized objects. See the for more details. Added RBAC reconcile commands with `kubectl auth reconcile -f FILE`. When passed a file which contains RBAC roles, rolebindings, clusterroles, or clusterrolebindings, this command computes covers and adds the missing rules. The logic required to properly apply RBAC permissions is more complicated than a JSON merge because you have to compute logical covers operations between rule sets. This means that we cannot use `kubectl apply` to update RBAC roles without risking breaking old clients, such as controllers. `kubectl delete` no longer scales down workload API objects before deletion. Users who depend on ordered termination for the Pods of their StatefulSets must use `kubectl scale` to scale down the StatefulSet before deletion. `kubectl run --env` no longer supports CSV parsing. To provide multiple environment variables, use the `--env` flag multiple times instead. Example: `--env ONE=1 --env TWO=2` instead of `--env ONE=1,TWO=2`. Removed deprecated command `kubectl stop`. Kubectl can now use http caching for the OpenAPI schema. The cache directory can be configured by passing the `--cache-dir` command line flag to kubectl. If set to an empty string, caching is disabled. Kubectl now performs validation against OpenAPI schema instead of Swagger 1.2. If OpenAPI is not available on the server, it falls back to the old Swagger 1.2. Added Italian translation for kubectl. Added German translation for kubectl. )() )() ) [stable] Mount options The ability to specify mount options for volumes is moved from beta to stable. A new `MountOptions` field in the `PersistentVolume` spec is available to specify mount options. This field replaces an annotation. A new `MountOptions` field in the `StorageClass` spec allows configuration of mount options for dynamically provisioned volumes. [stable] Support Attach and Detach operations for ReadWriteOnce (RWO) volumes that use iSCSI and Fibre Channel plugins. [stable] Expose storage usage metrics The available capacity of a given Persistent Volume (PV) is available by calling the Kubernetes metrics API. [stable] Volume plugin metrics Success and latency metrics for all Kubernetes calls are available by calling the Kubernetes metrics

You can request volume operations, including mount, unmount, attach, detach, provision, and delete. [stable] The PV spec for Azure File, CephFS, iSCSI, and Glusterfs is modified to reference namespaced resources. [stable] You can now customize the iSCSI initiator name per volume in the iSCSI volume plugin. [stable] You can now specify the World Wide Identifier (WWID) for the volume identifier in the Fibre Channel volume plugin. [beta] Reclaim policy in StorageClass You can now configure the reclaim policy in StorageClass, instead of defaulting to `delete` for dynamically provisioned volumes. [alpha] Volume resizing You can now increase the size of a volume by calling the Kubernetes API. For alpha, this feature increases only the size of the underlying volume. It does not support resizing the file system. For alpha, volume resizing supports only Gluster volumes. [alpha] Provide capacity isolation and resource management for local ephemeral storage You can now set container requests, container limits, and node allocatable reservations for the new `ephemeral-storage` resource. The `ephemeral-storage` resource includes all the disk space a container might consume with container overlay or scratch. [alpha] Mount namespace propagation The `VolumeMount.Propagation` field for `VolumeMount` in pod containers is now available. You can now set `VolumeMount.Propagation` to `Bidirectional` to enable a particular mount for a container to propagate itself to the host or other containers. [alpha] Improve Flex volume deployment Flex volume driver deployment is simplified in the following ways: New driver files can now be automatically discovered and initialized without requiring a kubelet or controller-manager restart. A sample DaemonSet to deploy Flexvolume drivers is now available. [prototype] Volume snapshots You can now create a volume snapshot by calling the Kubernetes API. Note that the prototype does not support quiescing before snapshot, so snapshots might be inconsistent. In the prototype phase, this feature is external to the core Kubernetes. It's available at https://github.com/kubernetes-incubator/external-storage/tree/master/snapshot. Federated Jobs that are automatically deployed to multiple clusters are now supported. Cluster selection and weighting determine how Job parallelism and completions are spread across clusters. Federated Job status reflects the aggregate status across all underlying cluster jobs. Federated HPAs are similar to the traditional Kubernetes HPAs, except that they span multiple clusters. Creating a Federated HPA targeting multiple clusters ensures that cluster-level autoscalers are consistently deployed across those clusters, and dynamically managed to ensure that autoscaling can occur optimially in all clusters, within a set of global constraints on the total number of replicas permitted across all clusters. If replicas are not required in some clusters due to low system load or insufficient quota or capacity in those clusters, additional replicas are made available to the autoscalers in other clusters if required. Support for custom metrics in the Horizontal Pod Autoscaler is now at v1beta1. The associated metrics APIs (custom metrics and resource/master metrics) were also moved to v1beta1. For more information, see . `metrics-server` is now the recommended way to provide the resource metrics API. Deploy `metrics-server` as an add-on in the same way that you deploy Heapster. Cluster autoscaler is now GA Cluster support size is increased to 1000 nodes Respect graceful pod termination of up to 10 minutes Handle zone stock-outs and failures Improve monitoring and error reporting , ) : CRI implementation for OCI-based runtimes ] Passed all the Kubernetes 1.7 end-to-end conformance test suites. Verification against Kubernetes 1.8 is planned soon after the release. : CRI implementation for hypervisor-based runtimes is now v1.1. ] Enhance CNI plugin compatibility, supports flannel, calico, weave and so

Pass all CRI validation conformance tests and node end-to-end conformance tests. Add experimental Unikernel support. : CRI implementation for containerd is now v1.0.0-alpha.0, ] Feature complete. Support the full CRI API defined in v1.8. Pass all the CRI validation tests and regular node end-to-end tests. An ansible playbook is provided to configure a Kubernetes cri-containerd cluster with kubeadm. Add support in Kubelet to consume container metrics via CRI. ] There are known bugs that result in errors when querying Kubelet's stats summary API. We expect to fix them in v1.8.1. , , ) , ) , ) , ], ]) ] Fix journalctl leak Fix container memory rss Fix incorrect CPU usage with 4.7 kernel OOM parser uses kmsg Add hugepages support Add CRI-O support Sharing a PID namespace between containers in a pod is disabled by default in version 1.8. To enable for a node, use the `--docker-disable-shared-pid=false` kubelet flag. Be aware that PID namespace sharing requires Docker version greater than or equal to 1.13.1. Fix issues related to the eviction manager. Fix inconsistent Prometheus cAdvisor metrics. Fix issues related to the local storage allocatable feature. [GA] The RBAC API group has been promoted from v1beta1 to v1. No API changes were introduced. [beta] Advanced auditing has been promoted from alpha to beta. The webhook and logging policy formats have changed since alpha, and may require modification. [beta] Kubelet certificate rotation through the certificates API has been promoted from alpha to beta. RBAC cluster roles for the certificates controller have been added for common uses of the certificates API, such as the kubelet's. [beta] SelfSubjectRulesReview, an API that lets a user see what actions they can perform with a namespace, has been added to the authorization.k8s.io API group. This bulk query is intended to enable UIs to show/hide actions based on the end user, and for users to quickly reason about their own permissions. [alpha] Building on the 1.7 work to allow encryption of resources such as secrets, a mechanism to store resource encryption keys in external Key Management Systems (KMS) was introduced. This complements the original file-based storage and allows integration with multiple KMS. A Google Cloud KMS plugin was added and will be usable once the Google side of the integration is complete. Websocket requests may now authenticate to the API server by passing a bearer token in a websocket subprotocol of the form `base64url.bearer.authorization.k8s.io.<base64url-encoded-bearer-token>`. (, ) Advanced audit now correctly reports impersonated user info. (, ) Advanced audit policy now supports matching subresources and resource names, but the top level resource no longer matches the subresouce. For example "pods" no longer matches requests to the logs subresource of pods. Use "pods/logs" to match subresources. (, ) Previously a deleted service account or bootstrapping token secret would be considered valid until it was reaped. It is now invalid as soon as the `deletionTimestamp` is set. (, ; , ) The `--insecure-allow-any-token` flag has been removed from the API server. Users of the flag should use impersonation headers instead for debugging. (, ) The NodeRestriction admission plugin now allows a node to evict pods bound to itself. (, ) The OwnerReferencesPermissionEnforcement admission plugin now requires `update` permission on the `finalizers` subresource of the referenced owner in order to set `blockOwnerDeletion` on an owner reference. (, ) The SubjectAccessReview API in the `authorization.k8s.io` API group now allows providing the user uid. (, ) After a kubelet rotates its client cert, it now closes its connections to the API server to force a handshake using the new

Previously, the kubelet could keep its existing connection open, even if the cert used for that connection was expired and rejected by the API server. (, ) PodSecurityPolicies can now specify a whitelist of allowed paths for host volumes. (, ) API server authentication now caches successful bearer token authentication results for a few seconds. (, ) The OpenID Connect authenticator can now use a custom prefix, or omit the default prefix, for username and groups claims through the --oidc-username-prefix and --oidc-groups-prefix flags. For example, the authenticator can map a user with the username "jane" to "google:jane" by supplying the "google:" username prefix. (, ) The bootstrap token authenticator can now configure tokens with a set of extra groups in addition to `system:bootstrappers`. (, ) Advanced audit allows logging failed login attempts. (, ) A `kubectl auth reconcile` subcommand has been added for applying RBAC resources. When passed a file which contains RBAC roles, rolebindings, clusterroles, or clusterrolebindings, it will compute covers and add the missing rules. (, ) , ) , ) NOTE:* Self-hosting will be the default way to host the control plane in the next release, v1.9 , ) NOTE:* This command is currently staged under `kubeadm alpha phase` and will be graduated to top level in a future release. , ). . (, ) , ). , , ). , , , ) , ) , ) , ) , ) Fixed an issue with `APIService` auto-registration. This issue affected rolling restarts of HA API servers that added or removed API groups being served.() ) Pods that are marked for deletion and have exceeded their grace period, but are not yet deleted, no longer count toward the resource quota.() Pod spec is mutable when the pod is uninitialized. The API server requires the pod spec to be valid even if it's uninitialized. Updating the status field of uninitialized pods is invalid.() Use of the alpha initializers feature now requires enabling the `Initializers` feature gate. This feature gate is automatically enabled if the `Initializers` admission plugin is enabled.() ) The webhook admission plugin now works even if the API server and the nodes are in two separate networks,for example, in GKE. The webhook admission plugin now lets the webhook author use the DNS name of the service as the CommonName when generating the server cert for the webhook. Action required: Regenerate the server cert for the admission webhooks. Previously, the CN value could be ignored while generating the server cert for the admission webhook. Now you must set it to the DNS name of the webhook service: `<service.Name>.<service.Namespace>.svc`.() [alpha] The CustomResourceDefinition API can now optionally based on a JSON schema provided in the CRD spec. Enable this alpha feature with the `CustomResourceValidation` feature gate in `kube-apiserver`. The garbage collector now supports custom APIs added via Custom Resource Definitions or aggregated API servers. The garbage collector controller refreshes periodically. Therefore, expect a latency of about 30 seconds between when an API is added and when the garbage collector starts to manage it. ) Add support for client-side spam filtering of events() Continuous integration builds use Docker versions 1.11.2, 1.12.6, 1.13.1, and 17.03.2. These versions were validated on Kubernetes 1.8. However, consult an appropriate installation or upgrade guide before deciding what versions of Docker to use. Docker 1.13.1 and 17.03.2 Shared PID namespace, live-restore, and overlay2 were validated. Known issues The default iptables FORWARD policy was changed from ACCEPT to DROP, which causes outbound container traffic to stop working by

See for the workaround. The support for the v1 registries was removed. Docker 1.12.6 Overlay2 and live-restore are not validated. Known issues Shared PID namespace does not work properly. () Docker reports incorrect exit codes for containers. () Docker 1.11.2 Known issues Kernel crash with Aufs storage driver on Debian Jessie (). The issue can be identified by using the node problem detector. File descriptor leak on init/control. () Additional memory overhead per container. () Processes may be leaked when Docker is repeatedly terminated in a short time frame. () & filename | sha256 hash -- | -- | `122d3ca2addb168c68e65a515bc42c21ad6c4bc71cb71591c699ba035765994b` | `8903266d4379f03059fcd9398d3bcd526b979b3c4b49e75aa13cce38de6f4e91` filename | sha256 hash -- | -- | `c4cae289498888db775abd833de1544adc632913e46879c6f770c931f29e5d3f` | `dd7081fc40e71be45cbae1bcd0f0932e5578d662a8054faea96c65efd1c1a134` | `728265635b18db308a69ed249dc4a59658aa6db7d23bb3953923f1e54c2d620f` | `2053862e5461f213c03381a9a05d70c0a28fdaf959600244257f6636ba92d058` | `956cc6b5afb816734ff439e09323e56210293089858cb6deea92b8d3318463ac` | `eca7ff447699849db3ae2d76ac9dad07be86c2ebe652ef774639bf006499ddbc` | `0d593c8034e54a683a629c034677b1c402e3e9516afcf174602e953818c8f0d1` | `9a7c1771d710d78f4bf45ff41f1a312393a8ee8b0506ee09aeca449c3552a147` | `345f50766c627e45f35705b72fb2f56e78cc824af123cf14f5a84954ac1d6c93` | `ea98c0872fa6df3eb5af6f1a005c014a76a0b4b0af9a09fdf90d3bc6a7ee5725` filename | sha256 hash -- | -- | `58799a02896f7d3c160088832186c8e9499c433e65f0f1eeb37763475e176473` | `cd28ad39762cdf144e5191d4745e2629f37851265dfe44930295a0b13823a998` | `62c75adbe94d17163cbc3e8cbc4091fdb6f5e9dc90a8471aac3f9ee38e609d82` | `cee4a1a33dec4facebfa6a1f7780aba6fee91f645fbc0a388e64e93c0d660b17` | `b263139b615372dd95ce404b8e94a51594e7d22b25297934cb189d3c9078b4fb` filename | sha256 hash -- | -- | `8d6688a224ebc5814e142d296072b7d2352fe86bd338539bd89ac9883b338c3d` | `1db47ce33af16d8974028017738a6d211a3c7c0b6f0046f70ccc52875ef6cbdf` | `ec5eaddbb2a338ab16d801685f98746c465aad45b3d1dcf4dcfc361bd18eb124` | `0ebf091215a2fcf1232a7f0eedf21f3786bbddae26619cf77098ab88670e1935` | `7443c6753cc6e4d9591064ad87c619b27713f6bb45aef5dcabb1046c2d19f0f3` | `b4bbb5521930fdc71dac52608c145e1e22cc2ab5e823492cbf1b7a46c317654a` New GCE or GKE clusters created with `cluster/kube-up.sh` will not enable the legacy ABAC authorizer by default. If you would like to enable the legacy ABAC authorizer, export ENABLELEGACYABAC=true before running `cluster/kube-up.sh`. (, ) kubeadm: Use the release-1.8 branch by default (, ) PersistentVolumeLabel admission controller is now deprecated. (, ) Mark the LBaaS v1 of OpenStack cloud provider deprecated. (, ) Mark image as deliberately optional in v1 Container struct. Many objects in the Kubernetes API inherit the container struct and only Pods require the field to be set. (, ) , ) Remove duplicate proto errors in kubelet. (, ) , ) Set defaults for successfulJobsHistoryLimit (3) and failedJobsHistoryLimit (1) in batch/v1beta1.CronJobs (, ) Fix: update system spec to support Docker 17.03 (, ) Fix panic in ControllerManager on GCE when it has a problem with creating external loadbalancer healthcheck (, ) PSP: add support for using `` as a value in `allowedCapabilities` to allow to request any capabilities (, ) , ) The autoscaling/v2beta1 API group is now enabled by default. (, ) Add CLUSTERSIGNINGDURATION environment variable to cluster (, ) configuration scripts to allow configuration of signing duration of certificates issued via the Certificate Signing Request API. Introduce policy to allow the HPA to consume the metrics.k8s.io and custom.metrics.k8s.io API groups. (, ) kubelet to master communication when doing node status updates now has a timeout to prevent indefinite hangs (, ) Introduced Metrics Server in version v0.2.0. For more details see https://github.com/kubernetes-incubator/metrics-server/releases/tag/v0.2.0. (, ) Adds ROTATE_CERTIFICATES environment variable to kube-up.sh script for GCE (, ) clusters. When that var is set to true, the command line flag enabling kubelet client certificate rotation will be added to the kubelet command line. Make sure that resources being updated are handled correctly by Quota system (, ) WATCHLIST calls are now reported as WATCH verbs in prometheus for the apiserver_request_ series. A new "scope" label is added to all apiserverrequest* values that is either 'cluster', 'resource', or 'namespace' depending on which level the query is performed at. (, ) Fixed the webhook admission plugin so that it works even if the apiserver and the nodes are in two networks (e.g., in GKE). (, ) Fixed the webhook admission plugin so that webhook author could use the DNS name of the service as the CommonName when generating the server cert for the webhook. Action required: Anyone who generated server cert for admission webhooks need to regenerate the

Previously, when generating server cert for the admission webhook, the CN value doesn't matter. Now you must set it to the DNS name of the webhook service, i.e., `<service.Name>.<service.Namespace>.svc`. Ignore pods marked for deletion that exceed their grace period in ResourceQuota (, ) custom resources that use unconventional pluralization now work properly with kubectl and garbage collection (, ) , ) dockershim: check the error when syncing the checkpoint. (, ) By default, clusters on GCE no longer sends RequestReceived audit event, if advanced audit is configured. (, ) , ) Azuredisk mount on windows node (, ) , ) kubeadm: Enable kubelet client certificate rotation (, ) Scheduler predicate developer should respect equivalence class cache (, ) The `kube-cloud-controller-manager` flag `--service-account-private-key-file` was non-functional and is now deprecated. (, ) The `kube-cloud-controller-manager` flag `--use-service-account-credentials` is now honored consistently, regardless of whether `--service-account-private-key-file` was specified. Fix credentials providers for docker sandbox image. (, ) Fixed an issue looking up cronjobs when they existed in more than one API version (, ) Add priority-based preemption to the scheduler. (, ) Add CLUSTERSIGNINGDURATION environment variable to cluster configuration scripts (, ) to allow configuration of signing duration of certificates issued via the Certificate Signing Request API. Adding German translation for kubectl (, ) The ScaleIO volume plugin can now read the SDC GUID value as node label scaleio.sdcGuid; if binary drvcfg is not installed, the plugin will still work properly; if node label not found, it defaults to drvcfg if installed. (, ) A policy with 0 rules should return an error (, ) Log a warning when --audit-policy-file not passed to apiserver (, ) & filename | sha256 hash -- | -- | `261e5ad47a718bcbb65c163f8e1130097e2d077541d6a68f3270de4e7256d796` | `e414e75cd1c72ca1fd202f6f0042ba1884b87bc6809bc2493ea2654c3d965656` filename | sha256 hash -- | -- | `b7745121e8d7074170f1ce8ded0fbc78b84abe8f8371933e97b76ba5551f26d8` | `4cc45a3a5dbd2ca666ea6dc2a973a17929c1427f5c3296224eade50d8df10b9e` | `a1dce30675b33e2c18a1343ee15556c9c65e85ee3c2b88f3cac414d95514a902` | `7fa5bbdc4af80a7ce00c5939896e8e93e962a66d195a95878f1e1fe4a06a5272` | `7d54528f892d3247e22093861c48407e7dc001304bb168cf8c882227d96fd6b2` | `17c074ae407b012b4bb2c88975c182df0317fefea98700fdadee12c70d114498` | `074801a87eedd2e93bdeb894822a70aa371983aafce86f66ed473a1a3bf4628b` | `2eb743f160b970a183b3ec81fc50108df2352b8a0c31951babb26e2c28fc8360` | `21e5686253052773d7e4baa08fd4ce56c861ad01d49d87df0eb80f56801e7cc4` | `07d2446c917cf749b38fa2bcaa2bd64af743df2ba19ad4b480c07be166f9ab16` filename | sha256 hash -- | -- | `811eb1645f8691e5cf7f75ae8ab26e90cf0b36a69254f73c0ed4ba91f4c0db99` | `e05c53ce80354d2776aa6832e074730aa35521f64ebf03a6c5a7753e7f2df8a3` | `57bc90e040faefa6af23b8637e8221a06282041ec9a16c2a630cc655d3c170df` | `4feb30aef4f79954907fdec34d4b7d2985917abd8e35b34a9440a468889cb240` | `85c0aaff6e832f711fb572582f10d9fe172c4d0680ac7589d1ec6e54742c436c` filename | sha256 hash -- | -- | `5809dce1c13d05c7c85bddc4d31804b30c55fe70209c9d89b137598c25db863e` | `d70c9d99f4b155b755728029036f68d79cff1648cfd3de257e3f2ce29bc07a31` | `efa29832aea28817466e25b55375574f314848c806d76fa0e4874f835399e9f0` | `991507d4cd2014e776d63ae7a14b3bbbbf49597211d4fa1751701f21fbf44417` | `4e1bd8e4465b2761632093a1235b788cc649af74d42dec297a97de8a0f764e46` | `4f80d4c269c6f05fb30c8c682f1cdbe46f3f0e86ac7ca4b84a1ab0a835bfb24a` The OwnerReferencesPermissionEnforcement admission plugin now requires `update` permission on the `finalizers` subresource of the referenced owner in order to set `blockOwnerDeletion` on an owner reference. (, ) The deprecated alpha and beta initContainer annotations are no longer supported. Init containers must be specified using the initContainers field in the pod spec. (, ) Action required: validation rule on metadata.initializers.pending, ) Audit policy supports matching subresources and resource names, but the top level resource no longer matches the subresouce. For example "pods" no longer matches requests to the logs subresource of pods. Use "pods/logs" to match subresources. (, ) Protobuf serialization does not distinguish between `, ) API fields previously capable of storing and returning either `[]` and `null` via JSON API requests (for example, the Endpoints `subsets` field) can now store only `null` when created using the protobuf content-type or stored in etcd using protobuf serialization (the default in 1.6+). JSON API clients should tolerate `null` values for such fields, and treat `null` and `[]` as equivalent in meaning unless specifically documented otherwise for a particular field. Fixes an issue with upgrade requests made via pod/service/node proxy subresources sending a non-absolute HTTP request-uri to backends (, ) kubeadm: add `kubeadm phase addons` command (, ) v2 of the autoscaling API group, including improvements to the HorizontalPodAutoscaler, has moved from alpha1 to beta1. (, ) Fixed a bug where some alpha features were enabled by

(, ) Implement StatsProvider interface using CRI stats (, ) set AdvancedAuditing feature gate to true by default (, ) Migrate the metrics/v1alpha1 API to metrics/v1beta1. The HorizontalPodAutoscaler (, ) controller REST client now uses that version. For v1beta1, the API is now known as resource-metrics.metrics.k8s.io. In GCE with COS, increase TasksMax for Docker service to raise cap on number of threads/processes used by containers. (, ) Fixes an issue with APIService auto-registration affecting rolling HA apiserver restarts that add or remove API groups being served. (, ) Sharing a PID namespace between containers in a pod is disabled by default in 1.8. To enable for a node, use the --docker-disable-shared-pid=false kubelet flag. Note that PID namespace sharing requires docker >= 1.13.1. (, ) Build test targets for all server platforms (, ) Add EgressRule to NetworkPolicy (, ) Allow DNS resolution of service name for COS using containerized mounter. It fixed the issue with DNS resolution of NFS and Gluster services. (, ) Fix journalctl leak on kubelet restart (, ) Fix container memory rss Add hugepages monitoring support Fix incorrect CPU usage metrics with 4.7 kernel Add tmpfs monitoring support Support for Huge pages in empty_dir volume plugin (, ) can now be used with empty dir volume plugin. Alpha support for pre-allocated hugepages (, ) add support for client-side spam filtering of events (, ) Provide a way to omit Event stages in audit policy (, ) Introduced Metrics Server (, ) Implement Controller for growing persistent volumes (, ) Kubernetes 1.8 supports docker version 1.11.x, 1.12.x and 1.13.x. And also supports overlay2. (, ) The Deployment, DaemonSet, and ReplicaSet kinds in the extensions/v1beta1 group version are now deprecated, as are the Deployment, StatefulSet, and ControllerRevision kinds in apps/v1beta1. As they will not be removed until after a GA version becomes available, you may continue to use these kinds in existing code. However, all new code should be developed against the apps/v1beta2 group version. (, ) kubeadm: Detect kubelet readiness and error out if the kubelet is unhealthy (, ) Fix providerID update validation (, ) Calico has been updated to v2.5, RBAC added, and is now automatically scaled when GCE clusters are resized. (, ) Add backoff policy and failed pod limit for a job (, ) Adds a new alpha EventRateLimit admission control that is used to limit the number of event queries that are accepted by the API Server. (, ) The OpenID Connect authenticator can now use a custom prefix, or omit the default prefix, for username and groups claims through the --oidc-username-prefix and --oidc-groups-prefix flags. For example, the authenticator can map a user with the username "jane" to "google:jane" by supplying the "google:" username prefix. (, ) Implemented `kubeadm upgrade plan` for checking whether you can upgrade your cluster to a newer version (, ) Implemented `kubeadm upgrade apply` for upgrading your cluster from one version to an other Switch to audit.k8s.io/v1beta1 in audit. (, ) update QEMU version to v2.9.1 (, ) controllers backoff better in face of quota denial (, ) The event table output under `kubectl describe` has been simplified to show only the most essential info. (, ) Use arm32v7|arm64v8 images instead of the deprecated armhf|aarch64 image organizations (, ) audit newest impersonated user info in the ResponseStarted, ResponseComplete audit stage (, ) Fixed bug in AWS provider to handle multiple IPs when using more than 1 network interface per ec2 instance. (, ) Add flag "--include-uninitialized" to kubectl annotate, apply, edit-last-applied, delete, describe, edit, get, label,

"--include-uninitialized=true" makes kubectl commands apply to uninitialized objects, which by default are ignored if the names of the objects are not provided. "--all" also makes kubectl commands apply to uninitialized objects. Please see the doc for more details. (, ) GCE: Service object now supports "Network Tiers" as an Alpha feature via annotations. (, ) When using kube-up.sh on GCE, user could set env `ENABLEPODPRIORITY=true` to enable pod priority feature gate. (, ) The names generated for ControllerRevision and ReplicaSet are consistent with the GenerateName functionality of the API Server and will not contain "bad words". (, ) PersistentVolumeClaim metrics like "volumestatsinodes" and "volumestatscapacity_bytes" are now reported via kubelet prometheus (, ) When using IP aliases, use a secondary range rather than subnetwork to reserve cluster IPs. (, ) IPAM controller unifies handling of node pod CIDR range allocation. (, ) It is intended to supersede the logic that is currently in range_allocator and cloudcidrallocator. (ALPHA FEATURE) Note: for this change, the other allocators still exist and are the default. It supports two modes: CIDR range allocations done within the cluster that are then propagated out to the cloud provider. Cloud provider managed IPAM that is then reflected into the cluster. Alpha list paging implementation (, ) add reconcile command to kubectl auth (, ) Advanced audit allows logging failed login attempts (, ) kubeadm: Add support for using an external CA whose key is never stored in the cluster (, ) the custom metrics API (custom.metrics.k8s.io) has moved from v1alpha1 to v1beta1 (, ) Add backoff policy and failed pod limit for a job (, ) Performs validation (when applying for example) against OpenAPI schema rather than Swagger 1.0. (, ) Make all e2e tests lookup image to use from a centralized place. In that centralized place, add support for multiple platforms. (, ) kubelet has alpha support for mount propagation. It is disabled by default and it is there for testing only. This feature may be redesigned or even removed in a future release. (, ) Add selfsubjectrulesreview API for allowing users to query which permissions they have in a given namespace. (, ) Kubelet re-binds /var/lib/kubelet directory with rshared mount propagation during startup if it is not shared yet. (, ) Deviceplugin jiayingz (, ) Make logdump support kubemark and support gke with 'usecustominstance_list' (, ) add apps/v1beta2 conversion test (, ) Fixed an issue () where `kubectl logs -f` failed with `unexpected stream type ""`. (, ) GCE: Internal load balancer IPs are now reserved during service sync to prevent losing the address to another service. (, ) Switch JSON marshal/unmarshal to json-iterator library. Performance should be close to previous with no generated code. (, ) Adds optional group and version information to the discovery interface, so that if an endpoint uses non-default values, the proper value of "kind" can be determined. Scale is a common example. (, ) introduced a condition where DaemonSet controller did not respect the TerminationGracePeriodSeconds of the Pods it created. This is now corrected. (, ) Add a persistent volume label controller to the cloud-controller-manager (, ) Tainted nodes by conditions as following: (, ) 'node.kubernetes.io/network-unavailable=:NoSchedule' if NetworkUnavailable is true 'node.kubernetes.io/disk-pressure=:NoSchedule' if DiskPressure is true 'node.kubernetes.io/memory-pressure=:NoSchedule' if MemoryPressure is true 'node.kubernetes.io/out-of-disk=:NoSchedule' if OutOfDisk is true rbd: default image format to v2 instead of deprecated v1 (, ) Surface reasonable error when client detects connection

(, ) Allow PSP's to specify a whitelist of allowed paths for host volume (, ) For Deployment, ReplicaSet, and DaemonSet, selectors are now immutable when updating via the new `apps/v1beta2` API. For backward compatibility, selectors can still be changed when updating via `apps/v1beta1` or `extensions/v1beta1`. (, ) Allows kubectl to use http caching mechanism for the OpenAPI schema. The cache directory can be configured through `--cache-dir` command line flag to kubectl. If set to empty string, caching will be disabled. (, ) Pod log attempts are now reported in apiserver prometheus metrics with verb `CONNECT` since they can run for very long periods of time. (, ) The `emptyDir.sizeLimit` field is now correctly omitted from API requests and responses when unset. (, ) Promote CronJobs to batch/v1beta1. (, ) Add local ephemeral storage support to LimitRange (, ) Add mount options field to StorageClass. The options listed there are automatically added to PVs provisioned using the class. (, ) Implement IPVS-based in-cluster service load balancing (, ) Release the kubelet client certificate rotation as beta. (, ) Adds --append-hash flag to kubectl create configmap/secret, which will append a short hash of the configmap/secret contents to the name during creation. (, ) Add validation for CustomResources via JSON Schema. (, ) enqueue a sync task to wake up jobcontroller to check job ActiveDeadlineSeconds in time (, ) Remove previous local ephemeral storage resource names: "ResourceStorageOverlay" and "ResourceStorageScratch" (, ) Add `retainKeys` to patchStrategy for v1 Volumes and extensions/v1beta1 DeploymentStrategy. (, ) Add mount options field to PersistentVolume spec (, ) Use of the alpha initializers feature now requires enabling the `Initializers` feature gate. This feature gate is auto-enabled if the `Initialzers` admission plugin is enabled. (, ) Fix inconsistent Prometheus cAdvisor metrics (, ) Add local ephemeral storage to downward API (, ) kubectl zsh autocompletion will work with compinit (, ) When using kube-up.sh on GCE, user could set env `KUBEPROXYDAEMONSET=true` to run kube-proxy as a DaemonSet. kube-proxy is run as static pods by default. (, ) Add --request-timeout to kube-apiserver to make global request timeout configurable. (, ) Deprecate auto detecting cloud providers in kubelet. Auto detecting cloud providers go against the initiative for out-of-tree cloud providers as we'll now depend on cAdvisor integrations with cloud providers instead of the core repo. In the near future, `--cloud-provider` for kubelet will either be an empty string or `external`. (, ) Add local ephemeral storage support to Quota (, ) Kubelet updates default labels if those are deprecated (, ) Add error count and time-taken metrics for storage operations such as mount and attach, per-volume-plugin. (, ) A new predicates, named 'CheckNodeCondition', was added to replace node condition filter. 'NetworkUnavailable', 'OutOfDisk' and 'NotReady' maybe reported as a reason when failed to schedule pods. (, ) Add support for configurable groups for bootstrap token authentication. (, ) Fix forbidden message format (, ) make volumesInUse sorted in node status updates (, ) Adds `InstanceExists` and `InstanceExistsByProviderID` to cloud provider interface for the cloud controller manager (, ) Dynamic Flexvolume plugin discovery. Flexvolume plugins can now be discovered on the fly rather than only at system initialization time. (, ) add fieldSelector spec.schedulerName (, ) Change eviction manager to manage one single local ephemeral storage resource (, ) Cloud Controller Manager now sets Node.Spec.ProviderID (, ) Parameterize session affinity timeout seconds in service API for Client IP based session

(, ) Changing scheduling part of the alpha feature 'LocalStorageCapacityIsolation' to manage one single local ephemeral storage resource (, ) set --audit-log-format default to json (, ) kubeadm: Implement a `--dry-run` mode and flag for `kubeadm` (, ) kubectl rollout `history`, `status`, and `undo` subcommands now support StatefulSets. (, ) Add IPBlock to Network Policy (, ) Adding Italian translation for kubectl (, ) Simplify capabilities handling in FlexVolume. (, ) cloudprovider.Zones should support external cloud providers (, ) Finalizers are now honored on custom resources, and on other resources even when garbage collection is disabled via the apiserver flag `--enable-garbage-collector=false` (, ) Renamed the API server flag `--experimental-bootstrap-token-auth` to `--enable-bootstrap-token-auth`. The old value is accepted with a warning in 1.8 and will be removed in 1.9. (, ) Azure file persistent volumes can use a new `secretNamespace` field to reference a secret in a different namespace than the one containing their bound persistent volume claim. The azure file persistent volume provisioner honors a corresponding `secretNamespace` storage class parameter to determine where to place secrets containing the storage account key. (, ) Bumped gRPC version to 1.3.0 (, ) Delete load balancers if the UIDs for services don't match. (, ) Show events when describing service accounts (, ) implement proposal 34058: hostPath volume type (, ) HostAlias is now supported for both non-HostNetwork Pods and HostNetwork Pods. (, ) CRDs support metadata.generation and implement spec/status split (, ) Allow attach of volumes to multiple nodes for vSphere (, ) & filename | sha256 hash -- | -- | `c99042c4826352b724dc02c8d92c01c49e1ad1663d2c55e0bce931fe4d76c1e3` | `3ee0cd3594bd5b326f042044d87e120fe335bd8e722635220dd5741485ab3493` filename | sha256 hash -- | -- | `c716e167383d118373d7b10425bb8db6033675e4520591017c688575f28a596d` | `dfe87cad00600049c841c8fd96c49088d4f7cdd34e5a903ef8048f75718f2d21` | `97242dffee822cbf4e3e373acf05e9dc2f40176b18f4532a60264ecf92738356` | `42e25e810333b00434217bae0aece145f82d0c7043faea83ff62bed079bae651` | `7f9683c90dc894ee8cd7ad30ec58d0d49068d35478a71b315d2b7805ec28e14a` | `76347a154128e97cdd81674045b28035d89d509b35dda051f2cbc58c9b67fed4` | `c991cbbf0afa6eccd005b6e5ea28b0b20ecbc79ab7d64e32c24e03fcf05b48ff` | `94c2c29e8fd20d2a5c4f96098bd5c7d879a78e872f59c3c58ca1c775a57ddefb` | `bc98fd5dc01c6e6117c2c78d65884190bf99fd1fec0904e2af05e6dbf503ccc8` | `e32b56dbc69045b5b2821a2e3eb3c3b4a18cf4c11afd44e0c7c9c0e67bb38d02` filename | sha256 hash -- | -- | `5446addff583b0dc977b91375f3c399242f7996e1f66f52b9e14c015add3bf13` | `91e3cffed119b5105f6a6f74f583113384a26c746b459029c12babf45f680119` | `d4cb93787651193ef4fdd1d10a4822101586b2994d6b0e04d064687df8729910` | `916e7f63a4e0c67d9f106fdda6eb24efcc94356b05cd9eb288e45fac9ff79fe8` | `15b999b08f5fe0d8252f8a1c7e936b9e06f2b01132010b3cece547ab00b45282` filename | sha256 hash -- | -- | `9120f6a06053ed91566d378a26ae455f521ab46911f257d64f629d93d143b369` | `30af817f5de0ecb8a95ec898fba5b97e6b4f224927e1cf7efaf2d5479b23c116` | `8b0913e461d8ac821c2104a1f0b4efe3151f0d8e8598e0945e60b4ba7ac2d1a0` | `a78a3a837c0fbf6e092b312472c89ef0f3872c268b0a5e1e344e725a88c0717d` | `a0a38c5830fc1b7996c5befc24502991fc8a095f82cf81ddd0a301163143a2c5` | `8af4253fe2c582843de329d12d84dbdc5f9f823f68ee08a42809864efc7c368d` Remove deprecated kubectl command aliases `apiversions, clusterinfo, resize, rollingupdate, run-container, update` (, ) The following deprecated flags have been removed from `kube-controller-manager`: `replication-controller-lookup-cache-size`, `replicaset-lookup-cache-size`, and `daemonset-lookup-cache-size`. Make sure you no longer attempt to set them. (, ) Beta annotations `service.beta.kubernetes.io/external-traffic` and `service.beta.kubernetes.io/healthcheck-nodeport` have been removed. Please use fields `service.spec.externalTrafficPolicy` and `service.spec.healthCheckNodePort` instead. (, ) A cluster using the AWS cloud provider will need to label existing nodes and resources with a ClusterID or the kube-controller-manager will not start. To run without a ClusterID pass --allow-untagged-cloud=true to the kube-controller-manager on startup. (, ) RBAC: the `system:node` role is no longer automatically granted to the `system:nodes` group in new clusters. It is recommended that nodes be authorized using the `Node` authorization mode instead. Installations that wish to continue giving all members of the `system:nodes` group the `system:node` role (which grants broad read access, including all secrets and configmaps) must create an installation-specific `ClusterRoleBinding`. (, ) StatefulSet: The deprecated `pod.alpha.kubernetes.io/initialized` annotation for interrupting StatefulSet Pod management is now ignored. If you were setting it to `true` or leaving it unset, no action is required. However, if you were setting it to `false`, be aware that previously-dormant StatefulSets may become active after upgrading. (, ) add some more deprecation warnings to cluster (, ) The --insecure-allow-any-token flag has been removed from kube-apiserver. Users of the flag should use impersonation headers instead for debugging. (, ) Restored cAdvisor prometheus metrics to the main port -- a regression that existed in v1.7.0-v1.7.2 (, ) cAdvisor metrics can now be scraped from `/metrics/cadvisor` on the kubelet ports. Note that you have to update your scraping jobs to get kubelet-only metrics from `/metrics` and `container_` metrics from `/metrics/cadvisor` Change the default kubeadm bootstrap token TTL from infinite to 24 hours. This is a breaking

If you require the old behavior, use `kubeadm init --token-ttl 0` / `kubeadm token create --ttl 0`. (, ) Remove duplicate command example from `kubectl port-forward --help` (, ) Adds a new `kubeadm config` command that lets users tell `kubeadm upgrade` what kubeadm configuration to use and lets users view the current state. (, ) Kubectl uses openapi for validation. If OpenAPI is not available on the server, it defaults back to the old Swagger. (, ) kubectl show node role if defined (, ) iSCSI volume plugin: iSCSI initiatorname support (, ) On AttachDetachController node status update, do not retry when node doesn't exist but keep the node entry in cache. (, ) Prevent unneeded endpoint updates (, ) Affinity in annotations alpha feature is no longer supported in 1.8. Anyone upgrading from 1.7 with AffinityInAnnotation feature enabled must ensure pods (specifically with pod anti-affinity PreferredDuringSchedulingIgnoredDuringExecution) with empty TopologyKey fields must be removed before upgrading to 1.8. (, ) - kubeadm now supports "ci/latest-1.8" or "ci-cross/latest-1.8" and similar labels. (, ) kubeadm: Adds dry-run support for kubeadm using the `--dry-run` option (, ) Change GCE installs (kube-up.sh) to use GCI/COS for node OS, by default. (, ) Use CollisionCount for collision avoidance when creating ControllerRevisions in StatefulSet controller (, ) AWS: Arbitrarily choose first (lexicographically) subnet in AZ (, ) Change CollisionCount from int64 to int32 across controllers (, ) fix GPU resource validation that incorrectly allows zero limits (, ) The `kubernetes.io/created-by` annotation is now deprecated and will be removed in v1.9. Use instead to determine which controller, if any, owns an object. (, ) Disable Docker's health check until we officially support it (, ) Add ControllerRevision to apps/v1beta2 (, ) StorageClass has a new field to configure reclaim policy of dynamically provisioned PVs. (, ) Rerun init containers when the pod needs to be restarted (, ) Resources outside the `kubernetes.io` namespace are integers and cannot be over-committed. (, ) apps/v1beta2 is enabled by default. DaemonSet, Deployment, ReplicaSet, and StatefulSet have been moved to this group version. (, ) TLS cert storage for self-hosted clusters is now configurable. You can store them as secrets (alpha) or as usual host mounts. (, ) Remove deprecated command 'kubectl stop' (, ) Add new Prometheus metric that monitors the remaining lifetime of certificates used to authenticate requests to the API server. (, ) Upgrade advanced audit to version v1beta1 (, ) Cluster Autoscaler - fixes issues with taints and updates kube-proxy cpu request. (, ) fluentd-elasticsearch addon: change the fluentd base image to fix crashes on systems with non-standard systemd installation (, ) advanced audit: shutdown batching audit webhook gracefully (, ) Add Priority admission controller for monitoring and resolving PriorityClasses. (, ) apiservers: add synchronous shutdown mechanism on SIGTERM+INT (, ) Fix kubernetes-worker charm hook failure when applying labels (, ) kubeadm: Implementing the controlplane phase (, ) Refactor addons into multiple packages (, ) Kubelet now manages `/etc/hosts` file for both hostNetwork Pods and non-hostNetwork Pods. (, ) After 1.8, admission controller will add 'MemoryPressure' toleration to Guaranteed and Burstable pods. (, ) A new predicates, named 'CheckNodeCondition', was added to replace node condition filter. 'NetworkUnavailable', 'OutOfDisk' and 'NotReady' maybe reported as a reason when failed to schedule pods. (, ) fix apps DeploymentSpec conversion issue (, ) fluentd-gcp addon: Fix a bug in the event-exporter, when repeated events were not sent to

(, ) not allowing "kubectl edit <resource>" when you got an empty list (, ) fixes kubefed's ability to create RBAC roles in version-skewed clusters (, ) API server authentication now caches successful bearer token authentication results for a few seconds. (, ) Added field CollisionCount to StatefulSetStatus in both apps/v1beta1 and apps/v1beta2 (, ) FC volume plugin: Support WWID for volume identifier (, ) kubeadm: added enhanced TLS validation for token-based discovery in `kubeadm join` using a new `--discovery-token-ca-cert-hash` flag. (, ) federation: Support for leader-election among federation controller-manager instances introduced. (, ) New get-kube.sh option: KUBERNETESSKIPRELEASE_VALIDATION (, ) Azure: Allow VNet to be in a separate Resource Group. (, ) fix bug when azure cloud provider configuration file is not specified (, ) The `rbac.authorization.k8s.io/v1beta1` API has been promoted to `rbac.authorization.k8s.io/v1` with no changes. (, ) The `rbac.authorization.k8s.io/v1alpha1` version is deprecated and will be removed in a future release. Fix an issue where if a CSR is not approved initially by the SAR approver is not retried. (, ) The v1.Service.PublishNotReadyAddresses field is added to notify DNS addons to publish the notReadyAddresses of Enpdoints. The "service.alpha.kubernetes.io/tolerate-unready-endpoints" annotation has been deprecated and will be removed when clients have sufficient time to consume the field. (, ) vSphere cloud provider: vSphere cloud provider code refactoring (, ) `cluster/gke` has been removed. GKE end-to-end testing should be done using `kubetest --deployment=gke` (, ) kubeadm: Upload configuration used at 'kubeadm init' time to ConfigMap for easier upgrades (, ) Adds (alpha feature) the ability to dynamically configure Kubelets by enabling the DynamicKubeletConfig feature gate, posting a ConfigMap to the API server, and setting the spec.configSource field on Node objects. See the proposal at https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/dynamic-kubelet-configuration.md for details. (, ) Remove deprecated ScheduledJobs endpoints, use CronJobs instead. (, ) , ) fuse daemons for GlusterFS and CephFS are now run in their own systemd scope when Kubernetes runs on a system with systemd. (, ) `kubectl proxy` will now correctly handle the `exec`, `attach`, and `portforward` commands. You must pass `--disable-filter` to the command in order to allow these endpoints. (, ) Copy annotations from a StatefulSet's metadata to the ControllerRevisions it owns (, ) Make rolling update the default update strategy for v1beta2.DaemonSet and v1beta2.StatefulSet (, ) Deprecate Deployment .spec.rollbackTo field (, ) Collect metrics from Heapster in Stackdriver mode. (, ) , ) Relax restrictions on environment variable names. (, ) The node condition 'NodeInodePressure' was removed, as kubelet did not report it. (, ) Fix premature return (, ) StatefulSet uses scale subresource when scaling in accord with ReplicationController, ReplicaSet, and Deployment implementations. (, ) Feature gates now determine whether a cluster is self-hosted. For more information, see the FeatureGates configuration flag. (, ) Updates Cinder AttachDisk operation to be more reliable by delegating Detaches to volume manager. (, ) add fieldSelector podIP (, ) Return Audit-Id http response header for trouble shooting (, ) Status objects for 404 API errors will have the correct APIVersion (, ) Fix incorrect retry logic in scheduler (, ) Enforce explicit references to API group client interfaces in clientsets to avoid ambiguity. (, ) update dashboard image version (, ) kubeadm: Implementing the kubeconfig phase fully (, ) fixes a bug around using the Global config ElbSecurityGroup where Kuberentes would modify the passed in Security

(, ) Fluentd DaemonSet in the fluentd-elasticsearch addon is configured via ConfigMap and includes journald plugin (, ) Elasticsearch StatefulSet in the fluentd-elasticsearch addon uses local storage instead of PVC by default Add possibility to use multiple floatingip pools in openstack loadbalancer (, ) The 504 timeout error was returning a JSON error body that indicated it was a 500. The body contents now correctly report a 500 error. (, ) add examples for kubectl run --labels (, ) Kubelet will by default fail with swap enabled from now on. The experimental flag "--experimental-fail-swap-on" has been deprecated, please set the new "--fail-swap-on" flag to false if you wish to run with /proc/swaps on. (, ) Fix bug in scheduler that caused initially unschedulable pods to stuck in Pending state forever. (, ) GCE: Bump GLBC version to 0.9.6 (, ) Remove 0,1,3 from rand.String, to avoid 'bad words' (, ) Fix data race during addition of new CRD (, ) Do not try to run preStopHook when the gracePeriod is 0 (, ) The SubjectAccessReview API in the authorization.k8s.io API group now allows providing the user uid. (, ) Increase default value of apps/v1beta2 DeploymentSpec.RevisionHistoryLimit to 10 (, ) Upgrade Elasticsearch/Kibana to 5.5.1 in fluentd-elasticsearch addon (, ) Switch to basing our image of Elasticsearch in fluentd-elasticsearch addon off the official one Switch to the official image of Kibana in fluentd-elasticsearch addon Use StatefulSet for Elasticsearch instead of ReplicationController, with persistent volume claims Require authenticating towards Elasticsearch, as Elasticsearch 5.5 by default requires basic authentication Rebase hyperkube image on debian-hyperkube-base, based on debian-base. (, ) change apps/v1beta2 StatefulSet observedGeneration (optional field) from a pointer to an int for consistency (, ) After a kubelet rotates its client cert, it now closes its connections to the API server to force a handshake using the new cert. Previously, the kubelet could keep its existing connection open, even if the cert used for that connection was expired and rejected by the API server. (, ) Improve our Instance Metadata coverage in Azure. (, ) Add etcd connectivity endpoint to healthz (, ) kube-proxy will emit "FailedToStartNodeHealthcheck" event when fails to start healthz server. (, ) Fixed a bug in the API server watch cache, which could cause a missing watch event immediately after cache initialization. (, ) Enforcement of fsGroup; enable ScaleIO multiple-instance volume mapping; default PVC capacity; alignment of PVC, PV, and volume names for dynamic provisioning (, ) In GCE, add measures to prevent corruption of known_tokens.csv. (, ) kubeadm: Fix join preflight check false negative (, ) route_controller will emit "FailedToCreateRoute" event when fails to create route. (, ) Fix incorrect parsing of io_priority in Portworx volume StorageClass and add support for new parameters. (, ) The API Server now automatically creates RBAC ClusterRoles for CSR approving. (, ) Each deployment method should bind users/groups to the ClusterRoles if they are using this feature. Adds AllowPrivilegeEscalation to control whether a process can gain more privileges than its parent process (, ) `hack/local-up-cluster.sh` now enables the Node authorizer by default. Authorization modes can be overridden with the `AUTHORIZATIONMODE` environment variable, and the `ENABLERBAC` environment variable is no longer used. (, ) rename stop.go file to delete.go to avoid confusion (, ) Adding option to set the federation api server port if nodeport is set (, ) The garbage collector now supports custom APIs added via CustomResourceDefinition or aggregated apiservers. Note that the garbage collector controller refreshes periodically, so there is a latency between when the API is added and when the garbage collector starts to manage it. (, ) set the juju master charm state to blocked if the services appear to be failing (, ) keep-terminated-pod-volumes flag on kubelet is deprecated. (, ) kubectl describe podsecuritypolicy describes all

(, ) Added flag support to kubectl plugins (, ) Adding metrics support to local volume (, ) Bug fix: Parsing of `--requestheader-group-headers` in requests should be case-insensitive. (, ) Fix instance metadata service URL. (, ) Add a new API object apps/v1beta2.ReplicaSet (, ) fix pdb validation bug on PodDisruptionBudgetSpec (, ) Revert deprecation of vCenter port in vSphere Cloud Provider. (, ) Rev version of Calico's Typha daemon used in add-on to v0.2.3 to pull in bug-fixes. (, ) set default adminid for rbd deleter if unset (, ) Adding type apps/v1beta2.DaemonSet (, ) Fix nil value issue when creating json patch for merge (, ) Adds metrics for checking reflector health. (, ) remove deads2k from volume reviewer (, ) Unify genclient tags and add more fine control on verbs generated (, ) kubeadm: Fixes a small bug where `--config` and `--skip-` flags couldn't be passed at the same time in validation. (, ) Remove deprecated flags: --low-diskspace-threshold-mb and --outofdisk-transition-frequency, which are replaced by --eviction-hard (, ) Fixed OpenAPI Description and Nickname of API objects with subresources (, ) set RBD default values as constant vars (, ) Fix a bug with binding mount directories and files using flexVolumes (, ) PodPreset is not injected if conflict occurs while applying PodPresets to a Pod. (, ) `kubectl drain` no longer spins trying to delete pods that do not exist (, ) Support specifying of FSType in StorageClass (, ) The NodeRestriction admission plugin now allows a node to evict pods bound to itself (, ) more robust stat handling from ceph df output in the kubernetes-master charm create-rbd-pv action (, ) added cronjobs.batch to all, so kubectl get all returns them. (, ) Update status to show failing services. (, ) Fixes where kube-controller-manager can panic on volume.CanSupport methods and enter a crash loop. (, ) Add a new API version apps/v1beta2 (, ) Websocket requests to aggregated APIs now perform TLS verification using the service DNS name instead of the backend server's IP address, consistent with non-websocket requests. (, ) kubeadm: Don't set a specific `spct` SELinux label on the etcd Static Pod as that is more privs than etcd needs and due to that `spct` isn't compatible with some OSes. (, ) GCE Cloud Provider: New created LoadBalancer type Service will have health checks for nodes by default if all nodes have version >= v1.7.2. (, ) hack/local-up-cluster.sh now enables RBAC authorization by default (, ) Use port 20256 for node-problem-detector in standalone mode. (, ) Fixed unmounting of vSphere volumes when kubelet runs in a container. (, ) use informers for quota evaluation of core resources where possible (, ) additional backoff in azure cloudprovider (, ) allow impersonate serviceaccount in cli (, ) Add PriorityClass API object under new "scheduling" API group (, ) Added golint check for pkg/kubelet. (, ) azure: acr: support MSI with preview ACR with AAD auth (, ) Set default CIDR to /16 for Juju deployments (, ) Fix pod preset to ignore input pod namespace in favor of request namespace (, ) Previously a deleted bootstrapping token secret would be considered valid until it was reaped. Now it is invalid as soon as the deletionTimestamp is set. (, ) Set default snap channel on charms to

stable (, ) prevent unsetting of nonexistent previous port in kubeapi-load-balancer charm (, ) kubeadm: Make kube-proxy tolerate the external cloud provider taint so that an external cloud provider can be easily used on top of kubeadm (, ) Fix Pods using Portworx volumes getting stuck in ContainerCreating phase. (, ) hpa: Prevent scaling below MinReplicas if desiredReplicas is zero (, ) Kubelet CRI: move seccomp from annotations to security context. (, ) Never prevent deletion of resources as part of namespace lifecycle (, ) The generic RESTClient type (`k8s.io/client-go/rest`) no longer exposes `LabelSelectorParam` or `FieldSelectorParam` methods - use `VersionedParams` with `metav1.ListOptions` instead. The `UintParam` method has been removed. The `timeout` parameter will no longer cause an error when using `Param()`. (, ) Support completion for kubectl config delete-cluster (, ) Could get the patch from kubectl edit command (, ) Added scheduler integration test owners. (, ) `kubectl run` learned how to set a service account name in the generated pod spec with the `--serviceaccount` flag. (, ) Fix share name generation in azure file provisioner. (, ) Fixed a bug where a jsonpath filter would return an error if one of the items being evaluated did not contain all of the nested elements in the filter query. (, ) Uses the port config option in the kubeapi-load-balancer charm. (, ) azure: support retrieving access tokens via managed identity extension (, ) Add a runtime warning about the kubeadm default token TTL changes. (, ) Azure PD (Managed/Blob) (, ) Redirect all examples README to the kubernetes/examples repo (, ) Fix a regression that broke the `--config` flag for `kubeadm init`. (, ) Fluentd-gcp DaemonSet exposes different set of metrics. (, ) MountPath should be absolute (, ) Updated comments of func in testapi. (, ) Fix service controller crash loop when Service with GCP LoadBalancer uses static IP (, ) (, ) Fix pods failing to start when subPath is a dangling symlink from kubelet point of view, which can happen if it is running inside a container (, ) Add initial support for the Azure instance metadata service. (, ) Added new flag to `kubeadm init`: --node-name, that lets you specify the name of the Node object that will be created (, ) Added pod evictors for new zone. (, ) kube-up and kubemark will default to using cos (GCI) images for nodes. (, ) The previous default was container-vm (CVM, "debian"), which is deprecated. If you need to explicitly use container-vm for some reason, you should set KUBENODEOS_DISTRIBUTION=debian kubectl: Fix bug that showed terminated/evicted pods even without `--show-all`. (, ) Fixed GlusterFS volumes taking too long to time out (, ) & filename | sha256 hash -- | -- | `26d8079fa6b2d82682db809827d260bbab8e6d0f45e457260b8c5ce640432426` | `141e5c1bf66b69f3c22870b2ab6159abc3b38c12cc20f41c8193044e16df3205` filename | sha256 hash -- | -- | `6ca63da27ca0c1efa04d079d90eba7e6f01a6e9581317892538be6a97ee64d95` | `0bfbd97f7fb7ce5e1228134d8ca40168553d179bfa44cbd5e925a6543fb3bbf5` | `29d395cc61c91c602e32412e51d4eae333942e6b9da235270768d11c040733c3` | `b1172bbb1d80ba29612d4de08dc4942b40b0f7d580dbb8ed4423c221f78920fe` | `994621c4a9d0644e3e8a4f12f563588036412bb72f0104b888f7a2605d3a8015` | `1e0dd9e4e9730a8cd54d8eb7036d5d7307bd930a91d0fcb105601b2d03fda15d` | `bdcf58f419b42d83ce8adb350388c962b8934782294f9715b617cdbdf201cc36` | `5c58217cffb34043fae951222bfd429165c68439f590c8fb8e33e54fe1cab0de` | `f78ec125f734433c9fc75a9d35dc7bdfa6d145f1cc071ff2e3a5435beef3368f` | `78dca9aadc140e2868b0a3d1a77b5058e22f24710f9c7956d755b473b575bb9d` filename | sha256 hash -- | -- | `802bb71cf19147857a50e842a00d50641f78fec5c5791a524639f7af70f9e1d4` | `b8f15c32320188981d5e75c474d4e826e45f59083eb66304151da112fb3052b1` | `8f800befc32d8402a581c47254db921d54caa31c50513c257b251435756918f1` | `a406bd0aaa92633dbb43216312971164b0230ea01c77679d12b9ffc873956d0d` | `8e038b4ccdfc89a08204927c8097a51bd9e786a97c2f9d73fca763ebee6c2373` filename | sha256 hash -- | -- | `1a9725cfb55991680fc75cb862d8a74d76f453be9e9f8ad043d62d5911ab50b9` | `44fbdd86048bea2cb3d2d6ec1b6cb2c4ae19cb32f6df28e15392cd7f028a4350` | `76d9d36aa182fb93aab7a01f22f7a008ad2906a6224b4c009074100676403337` | `07327ce6fe78bbae3d34b185b54ea0204bf875df488f0293ee1271599189160d` | `e84a8c638834c435f82560b86f1a14ec861a8fc967a7cd7055ab86526ce744d0` | `f0f69dc70751e3be2d564aa272f7fe67e86e91c7de3034776b98faddef51a73d` The deprecated ThirdPartyResource (TPR) API has been removed. To avoid losing your TPR data, you must before upgrading. (, ) Removed scheduler dependencies to testapi. (, ) kubeadm: Fix a bug where `kubeadm join` would wait 5 seconds without doing anything. Now `kubeadm join` executes the tasks immediately. (, ) Reduce amount of noise in Stackdriver Logging, generated by the event-exporter component in the fluentd-gcp

(, ) To allow the userspace proxy to work correctly on multi-interface hosts when using the non-default-route interface, you may now set the `bindAddress` configuration option to an IP address assigned to a network interface. The proxy will use that IP address for any required NAT operations instead of the IP address of the interface which has the default route. (, ) Move Mesos Cloud Provider out of Kubernetes Repo (, ) - kubeadm now can accept versions like "1.6.4" where previously it strictly required "v1.6.4" (, ) kubeadm: Implementing the certificates phase fully (, ) Added case on 'terminated-but-not-yet-deleted' for Admit. (, ) `kubectl run --env` no longer supports CSV parsing. To provide multiple env vars, use the `--env` flag multiple times instead of having env vars separated by commas. E.g. `--env ONE=1 --env TWO=2` instead of `--env ONE=1,TWO=2`. (, ) Local storage teardown fix (, ) support json output for log backend of advanced audit (, ) Requests with the query parameter `?watch=` are treated by the API server as a request to watch, but authorization and metrics were not correctly identifying those as watch requests, instead grouping them as list calls. (, ) As part of the NetworkPolicy "v1" changes, it is also now (, ) possible to update the spec field of an existing NetworkPolicy. (Previously you had to delete and recreate a NetworkPolicy if you wanted to change it.) Fix udp service blackhole problem when number of backends changes from 0 to non-0 (, ) kubeadm: Make self-hosting work by using DaemonSets and split it out to a phase that can be invoked via the CLI (, ) Added new flag to `kubeadm join`: --node-name, that lets you specify the name of the Node object that's gonna be created (, ) Fix Audit-ID header key (, ) Checked container spec when killing container. (, ) Fix kubectl describe for pods with controllerRef (, ) Skip errors when unregistering juju kubernetes-workers (, ) Configures the Juju Charm code to run kube-proxy with conntrack-max-per-core set to 0 when in an lxc as a workaround for issues when mounting /sys/module/nf_conntrack/parameters/hashsize (, ) Group and order imported packages. (, ) RBAC role and role-binding reconciliation now ensures namespaces exist when reconciling on startup. (, ) Fix charms leaving services running after remove-unit (, ) Added helper funcs to schedulercache.Resource. (, ) When performing a GET then PUT, the kube-apiserver must write the canonical representation of the object to etcd if the current value does not match. That allows external agents to migrate content in etcd from one API version to another, across different storage types, or across varying encryption levels. This fixes a bug introduced in 1.5 where we unintentionally stopped writing the newest data. (, ) Fixed kubernetes charms not restarting services after snap upgrades (, ) Fix: namespace-create have kubectl in path (, ) add validate for advanced audit policy (, ) Support NoSchedule taints correctly in DaemonSet controller. (, ) Adds configuration option for Swift object store container name to OpenStack Heat provider. (, ) Allow the system:heapster ClusterRole read access to deployments (, ) Ensure get_password is accessing a file that exists. (, ) GZip openapi schema if accepted by client (, ) Fixes issue where you could not mount NFS or glusterFS volumes using hostnames on GCI/GKE with COS images. (, ) Previously a deleted service account token secret would be considered valid until it was reaped. Now it is invalid as soon as the deletionTimestamp is set. (, ) Securing the cluster created by Juju (, ) addon-resizer flapping behavior was removed. (, ) Change default `httpGet` probe `User-Agent` to `kube-probe/<version

if none specified, overriding the default Go `User-Agent`. (, ) Registries backed by the generic Store's `Update` implementation support delete-on-update, which allows resources to be automatically deleted during an update provided: (, ) Garbage collection is enabled for the Store The resource being updated has no finalizers The resource being updated has a non-nil DeletionGracePeriodSeconds equal to 0 With this fix, Custom Resource instances now also support delete-on-update behavior under the same circumstances. Fixes an edge case where "kubectl apply view-last-applied" would emit garbage if the data contained Go format codes. (, ) Bumped Heapster to v1.4.0. (, ) More details about the release https://github.com/kubernetes/heapster/releases/tag/v1.4.0 In GCE and in a "private master" setup, do not set the network-plugin provider to CNI by default if a network policy provider is given. (, ) Add generic NoSchedule toleration to fluentd in gcp config. (, ) kubeadm: Expose only the cluster-info ConfigMap in the kube-public ns (, ) Fixes kubelet race condition in container manager. (, ) Bump GCE ContainerVM to container-vm-v20170627 (, ) Add PriorityClassName and Priority fields to PodSpec. (, ) Add a failsafe for etcd not returning a connection string (, ) Fix fluentd-gcp configuration to facilitate JSON parsing (, ) Setting env var ENABLEBIGCLUSTER_SUBNETS=true will allow kube-up.sh to start clusters bigger that 4095 Nodes on GCE. (, ) When determining the default external host of the kube apiserver, any configured cloud provider is now consulted (, ) Updated comments for functions. (, ) Fix setting juju worker labels during deployment (, ) `kubefed init` correctly checks for RBAC API enablement. (, ) The garbage collector now cascades deletion properly when deleting an object with propagationPolicy="background". This resolves issue , so that when a deployment is deleted with propagationPolicy="background", the garbage collector ensures dependent pods are deleted as well. (, ) Fix restart action on juju kubernetes-master (, ) e2e: bump kubelet's resurce usage limit (, ) Cluster Autoscaler 0.6 (, ) Checked whether balanced Pods were created. (, ) Update protobuf time serialization for a one second granularity (, ) Bumped Heapster to v1.4.0-beta.0 (, ) `kubectl api-versions` now always fetches information about enabled API groups and versions instead of using the local cache. (, ) Removes alpha feature gate for affinity annotations. (, ) Websocket requests may now authenticate to the API server by passing a bearer token in a websocket subprotocol of the form `base64url.bearer.authorization.k8s.io.<base64url-encoded-bearer-token>` (, ) Update cadvisor to v0.26.1 (, ) Bump up npd version to v0.4.1 (, ) Allow StorageClass Ceph RBD to specify image format and image features. (, ) Removed mesos related labels. (, ) Add RBAC support to fluentd-elasticsearch cluster addon (, ) Avoid redundant copying of tars during kube-up for gce if the same file already exists (, ) container runtime version has been added to the output of `kubectl get nodes -o=wide` as `CONTAINER-RUNTIME` (, ) cAdvisor binds only to the interface that kubelet is running on instead of all interfaces. (, ) The schema of the API that are served by the kube-apiserver, together with a small amount of generated code, are moved to k8s.io/api

(, ) & filename | sha256 hash -- | -- | `47088d4a0b79ce75a90e73b1dd7f864fc17fe5ff5cea553a072c7a277a70a104` | `ec2cb19b55e24c7b9728437fb9e39a442c07b68eaea636b2f6bb340e4b9696dc` filename | sha256 hash -- | -- | `c2fb538ce73f0ed74bd343485cd8873efcff580e4d948ea4bf2732f1b059e463` | `01a1cb673fbb764e47edaea07c1d3fdddd99bbd7b025f9b2498f38c99d5be4b2` | `5bebebf12fb39db8be10f9758a92ce385013d07e629741421b09da88bd9fc0f1` | `b02ae110b3694562b195189c3cb8eca21095153d0cb5552360053304dee425f1` | `e6220b9e62856ad8345cb845c1365b3f177ee22d6f9718f11a1f373d7a70fd21` | `e35c62a3781841898c91724af136fbb35fd99cf15ca5ec947c1a4bc2f6e4a73d` | `7b02c25a764bd367e9931006def88d3fc03cf9e846cce2e77cfbc95f0e206433` | `ab6ba1bf43dd28c776a8cc5cae44413c45a7405f2996c277aba5ee3f6f73e305` | `eb1516db15807111ef03547b0104dcb89a310481ef8f867a65f3c57f20f56e30` | `525e599a2846fe166a5f1eb14483edee9d6b866aa096e16896f6544afad31768` filename | sha256 hash -- | -- | `bb0a37bb1fefa735ec1eb651fec60c22b180c9bca1bd5e0317e1bcdbf4aa0819` | `68fd804bd1f4d944a25112a67ef8b1cbae55051b110134850715b6f51f93f40c` | `822161bee3e8b3b64bb7cea297264729b3cc6d6a008c86f16b4aef16cde5b0de` | `9354336df2694427e3d6bc9b0b1fe286f3f9a7f6ef8f239bd6319b4af1c02162` | `d4a87e3713f190a4cc7db1f43a6105c3c95e1eb8de45ae269b9bd1ecd52296ce` filename | sha256 hash -- | -- | `dc7c5865041008fcfdad050380fb33c23a361f7a1f4fbce78b164e2906a1b7f9` | `d572cec5ec679e5543e9ee5e2529a51bb8d5ca5f3773e4218c5491a0bd77b7a4` | `4b0fae35ed01ca66fb0f82ea2ea7f804378f592d0c15425dc3934f4b7b6f19a8` | `d5684a2d1a640e7b0fdf82a3faa0edef2b20e50a83ff6baea461699b0d74b583` | `bb444cc79035044cfb58cbe3d7bccd7998522dcf6d993441cf29fd03c249897c` | `9b54e823c504601193b5ae2d37cb1d297ae9b5acfa1497b6f530a835071a7b6d` The following alpha API groups were unintentionally enabled by default in previous releases, and will no longer be enabled by default in v1.8: (, ) rbac.authorization.k8s.io/v1alpha1 settings.k8s.io/v1alpha1 If you wish to continue using them in v1.8, please enable them explicitly using the `--runtime-config` flag of the apiserver (for example, `--runtime-config="rbac.authorization.k8s.io/v1alpha1,settings.k8s.io/v1alpha1"`) Paths containing backsteps (for example, "../bar") are no longer allowed in hostPath volume paths, or in volumeMount subpaths (, ) Azure: Change container permissions to private for provisioned volumes. If you have existing Azure volumes that were created by Kubernetes v1.6.0-v1.6.5, you should change the permissions on them manually. (, ) New and upgraded 1.7 GCE/GKE clusters no longer have an RBAC ClusterRoleBinding that grants the `cluster-admin` ClusterRole to the `default` service account in the `kube-system` namespace. (, ) If this permission is still desired, run the following command to explicitly grant it, either before or after upgrading to 1.7: kubectl create clusterrolebinding kube-system-default --serviceaccount=kube-system:default --clusterrole=cluster-admin kube-apiserver: a new authorization mode (`--authorization-mode=Node`) authorizes nodes to access secrets, configmaps, persistent volume claims and persistent volumes related to their pods. (, ) Nodes must use client credentials that place them in the `system:nodes` group with a username of `system:node:<nodeName>` in order to be authorized by the node authorizer (the credentials obtained by the kubelet via TLS bootstrapping satisfy these requirements) When used in combination with the `RBAC` authorization mode (`--authorization-mode=Node,RBAC`), the `system:node` role is no longer automatically granted to the `system:nodes` group. kube-controller-manager has dropped support for the `--insecure-experimental-approve-all-kubelet-csrs-for-group` flag. Instead, the `csrapproving` controller uses authorization checks to determine whether to approve certificate signing requests: (, ) requests for a TLS client certificate for any node are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and `nodeclient` subresource in the `certificates.k8s.io` API group requests from a node for a TLS client certificate for itself are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and the `selfnodeclient` subresource in the `certificates.k8s.io` API group requests from a node for a TLS serving certificate for itself are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and the `selfnodeserver` subresource in the `certificates.k8s.io` API group Support updating storageclasses in etcd to storage.k8s.io/v1. You must do this prior to upgrading to 1.8. (, ) The namespace API object no longer supports the deletecollection operation. (, ) NetworkPolicy has been moved from `extensions/v1beta1` to the new (, ) `networking.k8s.io/v1` API group. The structure remains unchanged from the beta1 API. The `net.beta.kubernetes.io/network-policy` annotation on Namespaces to opt in to isolation has been removed. Instead, isolation is now determined at a per-pod level, with pods being isolated if there is any NetworkPolicy whose spec.podSelector targets them. Pods that are targeted by NetworkPolicies accept traffic that is accepted by any of the NetworkPolicies (and nothing else), and pods that are not targeted by any NetworkPolicy accept all traffic by default. Action Required: When upgrading to Kubernetes 1.7 (and a network plugin that supports the new NetworkPolicy v1 semantics), to ensure full behavioral compatibility with v1beta1: In Namespaces that previously had the "DefaultDeny" annotation, you can create equivalent v1 semantics by creating a NetworkPolicy that matches all pods but does not allow any traffic: ```yaml kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: default-deny spec: podSelector: ``` This will ensure that pods that aren't matched by any other NetworkPolicy will continue to be fully-isolated, as they were

In Namespaces that previously did not have the "DefaultDeny" annotation, you should delete any existing NetworkPolicy objects. These would have had no effect before, but with v1 semantics they might cause some traffic to be blocked that you didn't intend to be blocked. kubectl logs with label selector supports specifying a container name (, ) Adds an approval work flow to the certificate approver that will approve certificate signing requests from kubelets that meet all the criteria of kubelet server certificates. (, ) AWS: Maintain a cache of all instances, to fix problem with > 200 nodes with ELBs (, ) Bump GLBC version to 0.9.5 - fixes upon upgrade from pre-1.6.4 to either 1.6.4 or 1.6.5. (, ) Update cluster-proportional-autoscaler, metadata-proxy, and fluentd-gcp addons with fixes for CVE-2016-4448, CVE-2016-8859, CVE-2016-9841, CVE-2016-9843, and CVE-2017-9526. (, ) AWS: Batch DescribeInstance calls with nodeNames to 150 limit, to stay within AWS filter limits. (, ) AWS: Process disk attachments even with duplicate NodeNames (, ) kubefed will now configure NodeInternalIP as the federation API server endpoint when NodeExternalIP is unavailable for federation API servers exposed as NodePort services (, ) PodSecurityPolicy now recognizes pods that specify `runAsNonRoot: false` in their security context and does not overwrite the specified value (, ) Bump GLBC version to 0.9.4 (, ) Stackdriver Logging deployment exposes metrics on node port 31337 when enabled. (, ) Update to kube-addon-manager:v6.4-beta.2: kubectl v1.6.4 and refreshed base images (, ) Enable iptables -w in kubeadm selfhosted (, ) Azure plugin for client auth (, ) Fix dynamic provisioning of PVs with inaccurate AccessModes by refusing to provision when PVCs ask for AccessModes that can't be satisfied by the PVs' underlying volume plugin (, ) AWS: Avoid spurious ELB listener recreation - ignore case when matching protocol (, ) gce kube-up: The `Node` authorization mode and `NodeRestriction` admission controller are now enabled (, ) update gophercloud/gophercloud dependency for reauthentication fixes (, ) fix sync loop health check with separating runtime errors (, ) servicecontroller: Fix node selection logic on initial LB creation (, ) Fix iSCSI iSER mounting. (, ) StorageOS Volume Driver (, ) can be used as a storage provider for Kubernetes. With StorageOS, capacity from local or attached storage is pooled across the cluster, providing converged infrastructure for cloud-native applications. CRI has been moved to package `pkg/kubelet/apis/cri/v1alpha1/runtime`. (, ) Make gcp auth provider not to override the Auth header if it's already exits (, ) Allow pods to opt out of PodPreset mutation via an annotation on the pod. (, ) Add Traditional Chinese translation for kubectl (, ) Remove Initializers from admission-control in kubernetes-master charm for pre-1.7 (, ) Added state guards to the idle_status messaging in the kubernetes-master charm to make deployment faster on initial deployment. (, ) Bump up Node Problem Detector version to v0.4.0, which added support of parsing log from /dev/kmsg and ABRT. (, ) kubeadm: Enable the Node Authorizer/Admission plugin in v1.7 (, ) Deprecated Binding objects in 1.7. (, ) Add secretbox and AES-CBC encryption modes to at rest encryption. AES-CBC is considered superior to AES-GCM because it is resistant to nonce-reuse attacks, and secretbox uses Poly1305 and XSalsa20. (, ) The HorizontalPodAutoscaler controller will now only send updates when it has new status information, reducing the number of writes caused by the controller. (, ) gpusInUse info error when kubelet restarts (, ) kubeadm: Modifications to cluster-internal resources installed by kubeadm will be overwritten when upgrading from v1.6 to

(, ) Added exponential backoff to Azure cloudprovider (, ) fixed HostAlias in PodSpec to allow `foo.bar` hostnames instead of just `foo` DNS labels. (, ) Implements rolling update for StatefulSets. Updates can be performed using the RollingUpdate, Paritioned, or OnDelete strategies. OnDelete implements the manual behavior from 1.6. status now tracks (, ) replicas, readyReplicas, currentReplicas, and updatedReplicas. The semantics of replicas is now consistent with DaemonSet and ReplicaSet, and readyReplicas has the semantics that replicas did prior to this release. Add Japanese translation for kubectl (, ) federation: Add admission controller for policy-based placement (, ) Get command uses OpenAPI schema to enhance display for a resource if run with flag 'use-openapi-print-columns'. (, ) An example command: kubectl get pods --use-openapi-print-columns add gzip compression to GET and LIST requests (, ) Fix the bug where container cannot run as root when SecurityContext.RunAsNonRoot is false. (, ) Fixes a bug with cAdvisorPort in the KubeletConfiguration that prevented setting it to 0, which is in fact a valid option, as noted in issue . (, ) Stackdriver cluster logging now deploys a new component to export Kubernetes events. (, ) Alpha feature: allows users to set storage limit to isolate EmptyDir volumes. It enforces the limit by evicting pods that exceed their storage limits (, ) Adds the `Categories , ) Promote kubelet tls bootstrap to beta. Add a non-experimental flag to use it and deprecate the old flag. (, ) Fix disk partition discovery for brtfs (, ) Add ZFS support Add overlay2 storage driver support Support creation of GCP Internal Load Balancers from Service objects (, ) Introduces status conditions to the HorizontalPodAutoscaler in autoscaling/v2alpha1, indicating the current status of a given HorizontalPodAutoscaler, and why it is or is not scaling. (, ) Support OpenAPI spec aggregation for kube-aggregator (, ) Implement kubectl rollout undo and history for DaemonSet (, ) Respect PDBs during node upgrades and add test coverage to the ServiceTest upgrade test. (, ) Disk Pressure triggers the deletion of terminated containers on the node. (, ) Add the `alpha.image-policy.k8s.io/failed-open=true` annotation when the image policy webhook encounters an error and fails open. (, ) Enable kubelet csr bootstrap in GCE/GKE (, ) Implement Daemonset history (, ) When switching from the `service.beta.kubernetes.io/external-traffic` annotation to the new (, ) `externalTrafficPolicy` field, the values chnag as follows: "OnlyLocal" becomes "Local" "Global" becomes "Cluster". Fix kubelet reset liveness probe failure count across pod restart boundaries (, ) The gce metadata server can be hidden behind a proxy, hiding the kubelet's token. (, ) AWS: Allow configuration of a single security group for ELBs (, ) Allow remote admission controllers to be dynamically added and removed by administrators. External admission controllers make an HTTP POST containing details of the requested action which the service can approve or reject. (, ) iscsi storage plugin: Fix dangling session when using multiple target portal addresses. (, ) Duplicate recurring Events now include the latest event's Message string (, ) With --feature-gates=RotateKubeletClientCertificate=true set, the kubelet will (, ) request a client certificate from the API server during the boot cycle and pause waiting for the request to be satisfied. It will continually refresh the certificate as the certificates expiration approaches. The Kubernetes API supports retrieving tabular output for API resources via a new mime-type `application/json;as=Table;v=v1alpha1;g=meta.k8s.io`. The returned object (if the server supports it) will be of type `meta.k8s.io/v1alpha1` with `Table`, and contain column and row information related to the

Each row will contain information about the resource - by default it will be the object metadata, but callers can add the `?includeObject=Object` query parameter and receive the full object. In the future kubectl will use this to retrieve the results of `kubectl get`. (, ) This change add nonResourceURL to kubectl auth cani (, ) Webhook added to the API server which omits structured audit log events. (, ) By default, --low-diskspace-threshold-mb is not set, and --eviction-hard includes "nodefs.available<10%,nodefs.inodesFree<5%" (, ) kubectl edit and kubectl apply will keep the ordering of elements in merged lists (, ) , ) Restrict active deadline seconds max allowed value to be maximum uint32 (, ) Implement kubectl get controllerrevisions (, ) Local storage plugin (, ) With `--feature-gates=RotateKubeletServerCertificate=true` set, the kubelet will (, ) request a server certificate from the API server during the boot cycle and pause waiting for the request to be satisfied. It will continually refresh the certificate as the certificates expiration approaches. Allow PSP's to specify a whitelist of allowed paths for host volume based on path prefixes (, ) Add `kubectl config rename-context` (, ) Fix AWS EBS volumes not getting detached from node if routine to verify volumes are attached runs while the node is down (, ) Move hardPodAffinitySymmetricWeight to scheduler policy config (, ) AWS: support node port health check (, ) Add generic Toleration for NoExecute Taints to NodeProblemDetector (, ) support replaceKeys patch strategy and directive for strategic merge patch (, ) Augment CRI to support retrieving container stats from the runtime. (, ) Prevent kubelet from setting allocatable < 0 for a resource upon initial creation. (, ) add --non-resource-url to kubectl create clusterrole (, ) Add `kubectl apply edit-last-applied` subcommand (, ) Adding admissionregistration API group which enables dynamic registration of initializers and external admission webhooks. It is an alpha feature. (, ) Fix log spam due to unnecessary status update when node is deleted. (, ) GCE installs will now avoid IP masquerade for all RFC-1918 IP blocks, rather than just 10.0.0.0/8. This means that clusters can (, ) be created in 192.168.0.0./16 and 172.16.0.0/12 while preserving the container IPs (which would be lost before). `set selector` and `set subject` no longer print "running in local/dry-run mode..." at the top, so their output can be piped as valid yaml or json (, ) ControllerRevision type added for StatefulSet and DaemonSet history. (, ) Bump Go version to 1.8.3 (, ) Upgrade Elasticsearch Addon to v5.4.0 (, ) PodDisruptionBudget now uses ControllerRef to decide which controller owns a given Pod, so it doesn't get confused by controllers with overlapping selectors. (, ) aws: Support for ELB tagging by users (, ) Portworx volume driver no longer has to run on the master. (, ) kube-proxy: ratelimit runs of iptables by sync-period flags (, ) Deployments are updated to use (1) a more stable hashing algorithm (fnv) than the previous one (adler) and (2) a hashing collision avoidance mechanism that will ensure new rollouts will not block on hashing collisions anymore. (, ) The Prometheus metrics for the kube-apiserver for tracking incoming API requests and latencies now return the `subresource` label for correctly attributing the type of API call. (, ) Add Simplified Chinese translation for kubectl (, ) The --namespace flag is now honored for in-cluster clients that have an empty configuration. (, ) Fix init container status reporting when active deadline is exceeded. (, ) Improves performance of Cinder volume attach/detach operations (, ) GCE and AWS dynamic provisioners extension: admins can configure zone(s) in which a persistent volume shall be

(, ) Break the 'certificatesigningrequests' controller into a 'csrapprover' controller and 'csrsigner' controller. (, ) Modifies kubefed to create and the federation controller manager to use credentials associated with a service account rather than the user's credentials. (, ) Adds a MaxUnavailable field to PodDisruptionBudget (, ) The behavior of some watch calls to the server when filtering on fields was incorrect. If watching objects with a filter, when an update was made that no longer matched the filter a DELETE event was correctly sent. However, the object that was returned by that delete was not the (correct) version before the update, but instead, the newer version. That meant the new object was not matched by the filter. This was a regression from behavior between cached watches on the server side and uncached watches, and thus broke downstream API clients. (, ) vSphere cloud provider: vSphere Storage policy Support for dynamic volume provisioning (, ) Add support for emitting metrics from openstack cloudprovider about storage operations. (, ) 'kubefed init' now supports overriding the default etcd image name with the --etcd-image parameter. (, ) remove the elasticsearch template (, ) Adds the `CustomResourceDefinition` (crd) types to the `kube-apiserver`. These are the successors to `ThirdPartyResource`. See https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/thirdpartyresources.md for more details. (, ) StatefulSets now include an alpha scaling feature accessible by setting the `spec.podManagementPolicy` field to `Parallel`. The controller will not wait for pods to be ready before adding the other pods, and will replace deleted pods as needed. Since parallel scaling creates pods out of order, you cannot depend on predictable membership changes within your set. (, ) fix kubelet event recording for selected events. (, ) Moved qos to api.helpers. (, ) Kubelet PLEG updates the relist timestamp only after successfully relisting. (, ) OpenAPI spec is now available in protobuf binary and gzip format (with ETag support) (, ) Added support to a hierarchy of kubectl plugins (a tree of plugins as children of other plugins). (, ) Added exported env vars to kubectl plugins so that plugin developers have access to global flags, namespace, the plugin descriptor and the full path to the caller binary. Ignored mirror pods in PodPreset admission plugin. (, ) Don't try to attach volume to new node if it is already attached to another node and the volume does not support multi-attach. (, ) The Calico version included in kube-up for GCE has been updated to v2.2. (, ) Kubelet: Fix image garbage collector attempting to remove in-use images. (, ) Add ip-masq-agent addon to the addons folder which is used in GCE if --non-masquerade-cidr is set to 0/0 (, ) Fix serialization of EnforceNodeAllocatable (, ) Add --write-config-to flag to kube-proxy to allow users to write the default configuration settings to a file. (, ) The `NodeRestriction` admission plugin limits the `Node` and `Pod` objects a kubelet can modify. In order to be limited by this admission plugin, kubelets must use credentials in the `system:nodes` group, with a username in the form `system:node:<nodeName>`. Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node. (, ) vSphere cloud provider: Report same Node IP as both internal and external. (, ) The options passed to a flexvolume plugin's mount command now contains the pod name (`kubernetes.io/pod.name`), namespace (`kubernetes.io/pod.namespace`), uid (`kubernetes.io/pod.uid`), and service account name (`kubernetes.io/serviceAccount.name`). (, ) Please see the for older releases. Release notes of older releases can be found in: