• v1.16.15
  • Downloads for v1.16.15
    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries
  • Changelog since v1.16.14
  • Changes by Kind
    • Bug or Regression
  • Dependencies
    • Added
    • Changed
    • Removed
• v1.16.14
  • Downloads for v1.16.14
    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries
  • Changelog since v1.16.13
  • Changes by Kind
    • Bug or Regression
    • Other (Cleanup or Flake)
  • Dependencies
    • Added
    • Changed
    • Removed
• v1.16.13
  • Downloads for v1.16.13
    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries
  • Changelog since v1.16.12
  • Urgent Upgrade Notes
    • (No, really, you MUST read this before you upgrade)
  • Changes by Kind
    • Bug or Regression
  • Dependencies
    • Added
    • Changed
    • Removed
• v1.16.12
  • Downloads for v1.16.12
    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries
  • Changelog since v1.16.11
  • Changes by Kind
    • API Change
    • Bug or Regression
  • Dependencies
    • Added
    • Changed
    • Removed
• v1.16.12-rc.1
  • Downloads for v1.16.12-rc.1
    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries
  • Changelog since v1.16.11
  • Changes by Kind
    • API Change
    • Bug or Regression
  • Dependencies
    • Added
    • Changed
    • Removed
• v1.16.11
  • Downloads for v1.16.11
    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries
  • Changelog since v1.16.10
  • Changes by Kind
    • API Change
    • Feature
    • Bug or Regression
    • Other (Cleanup or Flake)
  • Dependencies
    • Added
    • Changed
    • Removed
• v1.16.10
  • Downloads for v1.16.10
    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries
  • Changelog since v1.16.9
  • Changes by Kind
    • API Change
    • Bug or Regression
    • Other (Cleanup or Flake)
  • Dependencies
    • Added
    • Changed
    • Removed
• v1.16.9
  • Downloads for v1.16.9
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.8
  • Changes by Kind
    • Feature
    • Bug or Regression
    • Other (Cleanup or Flake)
• v1.16.8
  • Downloads for v1.16.8
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.7
  • Changes by Kind
    • API Change
    • Other (Bug, Cleanup or Flake)
• v1.16.7
  • Downloads for v1.16.7
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.6
  • Changes by Kind
    • Other (Bug, Cleanup or Flake)
• v1.16.6
  • Downloads for v1.16.6
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.5
• v1.16.5
  • Downloads for v1.16.5
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.4
    • Other notable changes
• v1.16.4
  • Downloads for v1.16.4
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.3
    • Other notable changes
• v1.16.3
  • Downloads for v1.16.3
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.2
    • Other notable changes
• v1.16.2
  • Downloads for v1.16.2
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.1
    • Other notable changes
• v1.16.1
  • Downloads for v1.16.1
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.0
    • Other notable changes
• v1.16.0
  • Downloads for v1.16.0
    • Client Binaries
    • Server Binaries
    • Node Binaries
• Kubernetes v1.16.0 Release Notes
  • What’s New (Major Themes)
    • Additional Notable Feature Updates
  • Known Issues
  • Urgent Upgrade Notes
    • (No, really, you MUST read this before you upgrade)
      • Cluster Lifecycle
      • Storage
    • Deprecations and Removals
    • Metrics Changes
      • Added metrics
      • Removed metrics
      • Deprecated/changed metrics
    • Notable Features
      • Beta
      • Alpha
      • CLI Improvements
      • Misc
    • API Changes
    • Other notable changes
      • API Machinery
      • Apps
      • Auth
      • CLI
      • Cloud Provider
      • Cluster Lifecycle
      • Instrumentation
      • Network
      • Node
      • Scheduling
      • Storage
    • Testing
      • Windows
    • Dependencies
      • Changed
      • Unchanged
      • Removed
      • Detailed go Dependency Changes
        • Added
        • Changed
        • Removed
• v1.16.0-rc.2
  • Downloads for v1.16.0-rc.2
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.0-rc.1
    • Other notable changes
• v1.16.0-rc.1
  • Downloads for v1.16.0-rc.1
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.0-beta.2
    • Other notable changes
• v1.16.0-beta.2
  • Downloads for v1.16.0-beta.2
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.0-beta.1
    • Other notable changes
• v1.16.0-beta.1
  • Downloads for v1.16.0-beta.1
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.0-alpha.3
    • Action Required
    • Other notable changes
• v1.16.0-alpha.3
  • Downloads for v1.16.0-alpha.3
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.0-alpha.2
    • Action Required
    • Other notable changes
• v1.16.0-alpha.2
  • Downloads for v1.16.0-alpha.2
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.16.0-alpha.1
    • Action Required
    • Other notable changes
• v1.16.0-alpha.1
  • Downloads for v1.16.0-alpha.1
    • Client Binaries
    • Server Binaries
    • Node Binaries
  • Changelog since v1.15.0
    • Action Required
    • Other notable changes

• Correctly handle resetting cpuacct in a live container (#94040, @andyzhangx) [SIG Node and Windows]
• Fix uint64 overflow when elapsed (#94038, @andyzhangx) [SIG Node and Windows]
• Fix: incorrect max azure disk max count (#92331, @andyzhangx) [SIG Cloud Provider and Storage]
• Fixes a bug evicting pods after a taint with a limited tolerationSeconds toleration is removed from a node (#93722, @liggitt) [SIG Apps and Node]
• Fixes an issue that can result in namespaced custom resources being orphaned when their namespace is deleted, if the CRD defining the custom resource is removed concurrently with namespaces being deleted, then recreated. (#93790, @liggitt) [SIG API Machinery and Apps]
• Kube-apiserver: fixed a bug returning inconsistent results from list requests which set a field or label selector and set a paging limit (#94002, @wojtek-t) [SIG API Machinery]
• Use NLB Subnet CIDRs instead of VPC CIDRs in Health Check SG Rules (#93515, @t0rr3sp3dr0) [SIG Cloud Provider]

Nothing has changed.

• github.com/evanphx/json-patch: 162e562 → v4.9.0+incompatible

• github.com/jessevdk/go-flags: v1.4.0

• Do not add nodes labeled with kubernetes.azure.com/managed=false to backend pool of load balancer. (#93034, @matthias50) [SIG Cloud Provider]
• Fix instance not found issues when an Azure Node is recreated in a short time (#93316, @feiskyer) [SIG Cloud Provider]
• Fix: don't use docker config cache if it's empty (#92330, @andyzhangx) [SIG Cloud Provider]
• Fix: initial delay in mounting azure disk & file (#93052, @andyzhangx) [SIG Cloud Provider and Storage]
• Fixed a performance issue applying json patches to deeply nested objects (#93813, @liggitt) [SIG API Machinery, CLI, Cloud Provider and Cluster Lifecycle]
• Fixed a regression in kubeadm manifests for kube-scheduler and kube-controller-manager which caused continuous restarts because of failing health checks (#93208, @SataQiu) [SIG Cluster Lifecycle]
• Fixes a regression in kube-apiserver causing 500 errors from the /readyz endpoint (#93645, @ialidzhikov) [SIG API Machinery]

• Build: Update Debian base images
  • debian-base:v2.1.3
  • debian-iptables:v12.1.2
  • debian-hyperkube-base:v1.1.3 (#93927, @justaugustus) [SIG API Machinery, Cluster Lifecycle and Release]
• Kubernetes is now built with go1.13.15 (#93956, @justaugustus) [SIG Release and Testing]
• Update Golang to v1.13.14
  • Update bazel to 2.2.0
  • Update repo-infra to 0.0.8 (to support go1.14.6 and go1.13.14)
    • Includes:
      • bazelbuild/[email protected]
      • bazelbuild/[email protected] (#93235, @justaugustus) [SIG API Machinery, Release and Testing]

• github.com/jessevdk/go-flags: v1.4.0

• github.com/evanphx/json-patch: v4.2.0+incompatible → 162e562

Nothing has changed.

• CVE-2020-8559 (Medium): Privilege escalation from compromised node to cluster. See #92914 for more details. The API Server will no longer proxy non-101 responses for upgrade requests. This could break proxied backends (such as an extension API server) that respond to upgrade requests with a non-101 response code. (#92941, @tallclair) [SIG API Machinery]

• CVE-2020-8557 (Medium): Node-local denial of service via container /etc/hosts file. See #93032 for more details. (#92916, @joelsmith) [SIG Node]

• Extend kube-apiserver /readyz with new "informer-sync" check ensuring that internal informers are synced. (#92644, @wojtek-t) [SIG API Machinery and Testing]

• Fix: GetLabelsForVolume panic issue for azure disk PV (#92166, @andyzhangx) [SIG Cloud Provider]

• Fix: use force detach for azure disk (#91948, @andyzhangx) [SIG Cloud Provider]

• Fixes a problem with 63-second or 1-second connection delays with some VXLAN-based network plugins which was first widely noticed in 1.16 (though some users saw it earlier than that, possibly only with specific network plugins). If you were previously using ethtool to disable checksum offload on your primary network interface, you should now be able to stop doing that. (#92035, @danwinship) [SIG Network and Node]

• Kubeadm: add the deprecated flag --port=0 to kube-controller-manager and kube-scheduler manifests to disable insecure serving. Without this flag the components by default serve (e.g. /metrics) insecurely on the default node interface (controlled by --address). Users that wish to override this behavior and enable insecure serving can pass a custom --port=X via kubeadm's "extraArgs" mechanic for these components. (#92720, @neolit123) [SIG Cluster Lifecycle]

• hyperkube: Use [email protected] image

  Includes iproute2 to fix a regression in hyperkube images when using hyperkube as a kubelet (#92626, @justaugustus) [SIG Cluster Lifecycle, Network and Release]

Nothing has changed.

Nothing has changed.

Nothing has changed.

• Fixed: log timestamps now include trailing zeros to maintain a fixed width (#91207, @iamchuckss) [SIG Apps and Node]

• If firstTimestamp is not set use firstTimestamp or eventTime when printing event (#91056, @soltysh) [SIG CLI]

• hyperkube: Use [email protected] image

  A previous release built hyperkube using the [email protected], which was updated to address a CVE in the CNI plugins.

  A side-effect of using this new image was that the networking packages (namely iptables) drifted from the versions used in the kube-proxy images.

  The following issues were filed on kube-proxy failures when using hyperkube:

  • #92275
  • #92272
  • #92250

  To address this, the new debian-hyperkube-base image (v1.1.0) uses the debian-iptables base image (v12.1.0), which includes iptables-wrapper, a script used to determine the correct iptables mode to run in. (#92495, @justaugustus) [SIG Cluster Lifecycle and Release]

Nothing has changed.

Nothing has changed.

Nothing has changed.

• Fixed: log timestamps now include trailing zeros to maintain a fixed width (#91207, @iamchuckss) [SIG Apps and Node]

• If firstTimestamp is not set use firstTimestamp or eventTime when printing event (#91056, @soltysh) [SIG CLI]

• hyperkube: Use [email protected] image

  A previous release built hyperkube using the [email protected], which was updated to address a CVE in the CNI plugins.

  A side-effect of using this new image was that the networking packages (namely iptables) drifted from the versions used in the kube-proxy images.

  The following issues were filed on kube-proxy failures when using hyperkube:

  • #92275
  • #92272
  • #92250

  To address this, the new debian-hyperkube-base image (v1.1.0) uses the debian-iptables base image (v12.1.0), which includes iptables-wrapper, a script used to determine the correct iptables mode to run in. (#92495, @justaugustus) [SIG Cluster Lifecycle and Release]

Nothing has changed.

Nothing has changed.

Nothing has changed.

• Resolve regression in metadata.managedFields handling in update/patch requests submitted by older API clients (#91748, @apelisse) [SIG API Machinery and Testing]

• Extend AWS azToRegion method to support Local Zones (#90874, @Jeffwan) [SIG Cloud Provider]

• Azure: set dest prefix and port for IPv6 inbound security rule (#91831, @aramase) [SIG Cloud Provider]
• Fix internal loadbalancer configuration failure when subnet name too long (#86276, @yangl900) [SIG Cloud Provider]
• Fix public IP not shown issues after assigning public IP to Azure VMs (#90886, @feiskyer) [SIG Cloud Provider]
• Fixed a regression preventing garbage collection of RBAC role and binding objects (#90534, @apelisse) [SIG Auth]
• Fixed cleanup of raw block devices after kubelet restart. (#83451, @jsafrane) [SIG Node, Storage and Testing]
• Kubelet podresources API now provides the information about active pods only. (#79409, @takmatsu) [SIG Node]
• Pod Finalizers and Conditions updates are skipped for re-scheduling attempts (#91953, @alculquicondor) [SIG Scheduling]
• Resolve regression in metadata.managedFields handling in create/update/patch requests not using server-side apply (#91690, @apelisse) [SIG API Machinery and Testing]
• Resolves an issue using kubectl certificate approve/deny against a server serving the v1 CSR API (#91691, @liggitt) [SIG Auth and CLI]

• Update CNI to v0.8.6
  • build: Use [email protected] image (#91388, @justaugustus) [SIG Cluster Lifecycle, Network, Release and Testing]

Nothing has changed.

Nothing has changed.

Nothing has changed.

• Fix bug where sending a status update completely wipes managedFields for some types. (#90033, @apelisse) [SIG API Machinery and Testing]

• Base-images: Update to kube-cross:v1.13.9-5 (#90966, @justaugustus) [SIG Release]
• Fix HPA when using init containers and CRI-O (#90900, @joelsmith) [SIG Node]
• Fix: Init containers are now considered for the calculation of resource requests when scheduling (#90455, @alculquicondor) [SIG Scheduling]
• Fix: azure disk dangling attach issue which would cause API throttling (#90749, @andyzhangx) [SIG Cloud Provider]
• Fix: get attach disk error due to missing item in max count table (#89768, @andyzhangx) [SIG Cloud Provider and Storage]
• Fix: support removal of nodes backed by deleted non VMSS instances on Azure (#91184, @bpineau) [SIG Cloud Provider]
• Fixes a bug defining a default value for a replicas field in a custom resource definition that has the scale subresource enabled (#90022, @liggitt) [SIG API Machinery, CLI, Cloud Provider and Cluster Lifecycle]
• Pods that are considered for preemption and haven't started don't produce an error log. (#90241, @alculquicondor) [SIG Scheduling]
• Provides a fix to allow a cluster in a private Azure cloud to authenticate to ACR in the same cloud. (#90425, @DavidParks8) [SIG Cloud Provider]
• Reduced frequency of DescribeVolumes calls of AWS API when attaching/detaching a volume. Fixed "requested device X but found Y" attach error on AWS. (#89894, @johanneswuerbach) [SIG Cloud Provider]
• Scheduling failures due to no nodes available are now reported as unschedulable under schedule_attempts_total metric. (#90989, @ahg-g) [SIG Scheduling]

• base-images: Use debian-base:v2.1.0 (update to Debian Buster, includes CVE fixes)
• base-images: Use debian-iptables:v12.1.0 (update to Debian Buster, includes CVE fixes and iptables-nft/iptables-legacy wrapper) (#90940, @justaugustus) [SIG API Machinery, Cluster Lifecycle and Release]

Nothing has changed.

• k8s.io/kube-openapi: 743ec37 → 594e756

Nothing has changed.

Documentation

• deps: Update to Golang 1.13.9
  • build: Remove kube-cross image building (#89400, @justaugustus) [SIG Release and Testing]

• Client-go: resolves an issue with informers falling back to full list requests when timeouts are encountered, rather than re-establishing a watch. (#89977, @liggitt) [SIG API Machinery and Testing]
• Ensure Azure availability zone is always in lower cases. (#89722, @feiskyer) [SIG Cloud Provider]
• Fix invalid VMSS updates due to incorrect cache (#89002, @ArchangelSDY) [SIG Cloud Provider]
• Fix panic in kubelet when running IPv4/IPv6 dual-stack mode with a CNI plugin (#82508, @aanm) [SIG Network and Node]
• Fix the VMSS name and resource group name when updating Azure VMSS for LoadBalancer backendPools (#89337, @feiskyer) [SIG Cloud Provider]
• Fix: check disk status before delete azure disk (#88360, @andyzhangx) [SIG Cloud Provider]
• Fixed a data race in kubelet image manager that can cause static pod workers to silently stop working. (#88915, @roycaihw) [SIG Node]
• Fixed an issue that could cause the kubelet to incorrectly run concurrent pod reconciliation loops and crash. (#89055, @tedyu) [SIG Node]
• Fixes conversion error for HorizontalPodAutoscaler objects with invalid annotations (#89968, @liggitt) [SIG Autoscaling]
• Fixes conversion error in multi-version custom resources that could cause metadata.generation to increment on no-op patches or updates of a custom resource. (#88995, @liggitt) [SIG API Machinery]
• For GCE cluster provider, fix bug of not being able to create internal type load balancer for clusters with more than 1000 nodes in a single zone. (#89902, @wojtek-t) [SIG Cloud Provider, Network and Scalability]
• For volumes that allow attaches across multiple nodes, attach and detach operations across different nodes are now executed in parallel. (#89240, @verult) [SIG Apps, Node and Storage]
• Kubelet metrics gathered through metrics-server or prometheus should no longer timeout for Windows nodes running more than 3 pods. (#87730, @marosset) [SIG Node, Testing and Windows]
• Restores priority of static control plane pods in the cluster/gce/manifests control-plane manifests (#89970, @liggitt) [SIG Cluster Lifecycle and Node]

• Reduce event spam during a volume operation error. (#89794, @msau42) [SIG Storage]

Documentation

• Fixes a regression with clients prior to 1.15 not being able to update podIP in pod status, or podCIDR in node spec, against >= 1.16 API servers (#88505, @liggitt) [SIG Apps and Network]

• Add delays between goroutines for vm instance update (#88094, @aramase) [SIG Cloud Provider]
• Build: Enable kube-cross image-building on K8s Infra (#88596, @justaugustus) [SIG Release and Testing]
• Fix /readyz to return error immediately after a shutdown is initiated, before the --shutdown-delay-duration has elapsed. (#88954, @tkashem) [SIG API Machinery]
• Fix a bug in kube-proxy that caused it to crash when using load balancers with a different IP family (#87117, @aojea) [SIG Network]
• Fix a regression in kubenet that prevent pods to obtain ip addresses (#87287, @aojea) [SIG Network and Node]
• Fix handling of aws-load-balancer-security-groups annotation. Security-Groups assigned with this annotation are no longer modified by kubernetes which is the expected behaviour of most users. Also no unnecessary Security-Groups are created anymore if this annotation is used. (#88690, @Elias481) [SIG Cloud Provider]
• Fix route conflicted operations when updating multiple routes together (#88209, @feiskyer) [SIG Cloud Provider]
• Fix the problem where couple nodes becoming NotReady at the same time could cause master instability or even complete outage in large enough clusters. (#88959, @mborsz) [SIG Apps]
• Fix: add remediation in azure disk attach/detach (#88444, @andyzhangx) [SIG Cloud Provider]
• Fix: azure file mount timeout issue (#88610, @andyzhangx) [SIG Cloud Provider and Storage]
• Fix: corrupted mount point in csi driver (#88569, @andyzhangx) [SIG Storage]
• Fix: get azure disk lun timeout issue (#88158, @andyzhangx) [SIG Cloud Provider and Storage]
• Fixed threadSafeMap high memory usage caused by indices that have churn of high-cardinality keys. E.g. namespaces (#88007, @patrickshan) [SIG API Machinery]
• Fixes issue where you can't attach more than 15 GCE Persistent Disks to c2, n2, m1, m2 machine types. (#88602, @yuga711) [SIG Storage]
• Fixes kubelet crash in client certificate rotation cases (#88079, @liggitt) [SIG API Machinery, Auth and Node]
• Get-kube.sh uses the gcloud's current local GCP service account for auth when the provider is GCE or GKE instead of the metadata server default (#88383, @BenTheElder) [SIG Cluster Lifecycle]
• Golang/x/net has been updated to bring in fixes for CVE-2020-9283 (#88381, @BenTheElder) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle and Instrumentation]
• Limit number of instances in a single update to GCE target pool to 1000. (#87881, @wojtek-t) [SIG Cloud Provider, Network and Scalability]
• Update to use golang 1.13.8 (#87648, @ialidzhikov) [SIG Release and Testing]

Documentation

• Bind metrics-server containers to linux nodes to avoid Windows scheduling on kubernetes cluster includes linux nodes and windows nodes (#87022, @wawa0210) [SIG Cluster Lifecycle]
• Fix the bug PIP's DNS is deleted if no DNS label service annotation isn't set. (#87311, @nilo19) [SIG Cloud Provider]
• Fix: set nil cache entry based on old cache (#87592, @aramase) [SIG Cloud Provider]
• Fixed a bug which could prevent a provider ID from ever being set for node if an error occurred determining the provider ID when the node was added. (#87043, @zjs) [SIG Apps and Cloud Provider]
• Fixed the following
  • AWS Cloud Provider attempts to delete LoadBalancer security group it didn’t provision
  • AWS Cloud Provider creates default LoadBalancer security group even if annotation [service.beta.kubernetes.io/aws-load-balancer-security-groups] is present (#87207, @bhagwat070919) [SIG Cloud Provider]
• Fixed two scheduler metrics (pending_pods and schedule_attempts_total) not being recorded (#87692, @everpeace) [SIG Scheduling]
• Kubelet metrics have been changed to buckets. For example the exec/{podNamespace}/{podID}/{containerName} is now just exec. (#87913, @cheftako) [SIG Node]
• Openstack: Do not delete managed LB in case of security group reconciliation errors (#82264, @multi-io) [SIG Cloud Provider]
• Reverted a kubectl azure auth module change where oidc claim spn: prefix was omitted resulting a breaking behavior with existing Azure AD OIDC enabled api-server (#87507, @weinong) [SIG API Machinery, Auth and Cloud Provider]
• The client label for apiserver_request_count and apiserver_request_total now no-opts and merely records an empty string. (#87673, @logicalhan) [SIG API Machinery, Instrumentation and Scalability]
• The docker container runtime now enforces a 220 second timeout on container network operations. (#71653, @liucimin) [SIG Network and Node]

Documentation

No notable changes for this release

Documentation

• Fixed a regression where the kubelet would fail to update the ready status of pods. (#86191, @tedyu)
• Fix nil pointer dereference in azure cloud provider (#85975, @ldx)
• fix: azure disk could not mounted on Standard_DC4s/DC2s instances (#86612, @andyzhangx)
• Fixes issue where AAD token obtained by kubectl is incompatible with on-behalf-of flow and oidc. (#86412, @weinong)
  • The audience claim before this fix has "spn:" prefix. After this fix, "spn:" prefix is omitted.
• Fixes an issue with kubelet-reported pod status on deleted/recreated pods. (#86320, @liggitt)
• Kubernetes 1.16.5+ now requires go1.13.4+ to build (#85019, @liggitt)
• Fix LoadBalancer rule checking so that no unexpected LoadBalancer updates are made (#85990, @feiskyer)
• cherry pick of #85885: Provider/Azure: Add cache for VMSS. (#86049, @nilo19)
• Fixed a bug in the single-numa-policy of the TopologyManager. Previously, best-effort pods would result in a terminated state with a TopologyAffinity error. Now they will run as expected. (#83777, @lmdaly)

Documentation

• Fixed issue with addon-resizer using deprecated extensions APIs (#85793, @bskiba)
• Fixes a performance issue when using server-side apply with objects with very large atomic maps. (#85462, @jennybuckley)
• azure: update disk lock logic per vm during attach/detach to allow concurrent updates for different nodes. (#85115, @aramase)
• Filter published OpenAPI schema by making nullable, required fields non-required in order to avoid kubectl to wrongly reject null values. (#85733, @sttts)
• For x-kubernetes-list-type=set a scalar or atomic item type is now required, as documented. Persisted, invalid data is tolerated. (#85385, @sttts)
• Fixes a bug in kubeadm that caused init and join to hang indefinitely in specific conditions. (#85156, @chuckha)
• Ensure health probes are created for local traffic policy UDP services on Azure (#84802, @feiskyer)
• fix vmss dirty cache issue in disk attach/detach on vmss node (#85158, @andyzhangx)
• fix race condition when attach/delete azure disk in same time (#84917, @andyzhangx)
• set config.BindAddress to IPv4 address "127.0.0.1" if not specified (#83822, @zouyee)
• Change GCP ILB firewall names to contain the "k8s-fw-" prefix like the rest of the firewall rules. This is needed for consistency and also for other components to identify the firewall rule as k8s/service-controller managed. (#84622, @prameshj)
• kube-controller-manager: Fixes bug setting headless service labels on endpoints (#85361, @liggitt)

Documentation

• kubeadm: fix skipped etcd upgrade on secondary control-plane nodes when the command "kubeadm upgrade node" is used. (#85024, @neolit123)
• Fix kubelet metrics gathering on non-English Windows hosts (#84156, @wawa0210)
• Bump metrics-server to v0.3.5 (#83015, @olagacek)
• Bumps metrics-server version to v0.3.6 with following bugfix: (#83907, @olagacek) * Don't break metric storage when duplicate pod metrics encountered causing hpa to fail
• kube-apiserver: Fixed a regression accepting patch requests > 1MB (#84963, @liggitt)
• kube-apiserver: fixed a bug that could cause a goroutine leak if the apiserver encountered an encoding error serving a watch to a websocket watcher (#84693, @tedyu)
• azure: Add allow unsafe read from cache (#83685, @aramase)
• Add data cache flushing during unmount device for GCE-PD driver in Windows Server. (#83591, @jingxu97)
• Fixed binding of block PersistentVolumes / PersistentVolumeClaims when BlockVolume feature is off. (#84049, @jsafrane)
• kube-scheduler now fallbacks to emitting events using core/v1 Events when events.k8s.io/v1beta1 is disabled. (#83692, @yastij)
• Adds a metric apiserver_request_error_total to kube-apiserver. This metric tallies the number of request_errors encountered by verb, group, version, resource, subresource, scope, component, and code. (#83427, @logicalhan)
• Update Cluster Autoscaler version to 1.16.2 (CA release docs: https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-1.16.2) (#84038, @losipiuk)
• Fixed an issue with informers missing an Added event if a recently deleted object was immediately recreated at the same time the informer dropped a watch and relisted. (#83911, @matte21)
• CSI detach timeout increased from 10 seconds to 2 minutes (#84321, @cduchesne)
• Switched intstr.Type to sized integer to follow API guidelines and improve compatibility with proto libraries (#83956, @liggitt)
• Upgrade to etcd client 3.3.17 to fix bug where etcd client does not parse IPv6 addresses correctly when members are joining, and to fix bug where failover on multi-member etcd cluster fails certificate check on DNS mismatch (#83968, @jpbetz)
• Update to use go1.12.12 (#84064, @cblecker)
• Fix handling tombstones in pod-disruption-budged controller. (#83951, @zouyee)

Documentation

• Fixed panic when accessing CustomResources of a CRD with x-kubernetes-int-or-string. (#83789, @sttts)
• Fixed a bug in the single-numa-node policy of the TopologyManager. Previously, pods that only requested CPU resources and did not request any third-party devices would fail to launch with a TopologyAffinity error. Now they will launch successfully. (#83697, @klueska)
• Fixes kube-proxy bug accessing self nodeip:port on windows (#83027, @liggitt)
• Fix error where metrics related to dynamic kubelet config isn't registered (#83184, @odinuge)
• Use online nodes instead of possible nodes when discovering available NUMA nodes (#83196, @zouyee)
• Update Azure load balancer to prevent orphaned public IP addresses (#82890, @chewong)
• Fixes a goroutine leak in kube-apiserver when a request times out. (#83333, @lavalamp)
• Fix aggressive VM calls for Azure VMSS (#83102, @feiskyer)
• Fixes a flaw (CVE-2019-11253) in json/yaml decoding where large or malformed documents could consume excessive server resources. Request bodies for normal API requests (create/delete/update/patch operations of regular resources) are now limited to 3MB. (#83261, @liggitt)

Documentation

• Limit the body length of exec readiness/liveness probes. remote CRIs and Docker shim read a max of 16MB output of which the exec probe itself inspects 10kb. (#82514, @dims)
• Fix possible fd leak and closing of dirs when using openstack (#82873, @odinuge)
• Update to go 1.12.10 (#83139, @cblecker)
• Use ipv4 in wincat port forward. (#83036, @liyanhui1228)
• Fixes a panic in kube-controller-manager cleaning up bootstrap tokens (#82887, @tedyu)
• Resolves bottleneck in internal API server communication that can cause increased goroutines and degrade API Server performance (#80465, @answer1991)
• Resolves regression generating informers for packages whose names contain . characters (#82410, @nikhita)
• Fixed a scheduler panic when using PodAffinity. (#82841, @Huang-Wei)
• Update Cluster Autoscaler version to 1.16.1 (release notes: https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-1.16.1) (#83052, @losipiuk)
• Resolves issue with /readyz and /livez not including etcd and kms health checks (#82713, @logicalhan)
• fix: azure disk detach failure if node not exists (#82640, @andyzhangx)

Documentation

A complete changelog for the release notes is now hosted in a customizable format at relnotes.k8s.io. Check it out and please give us your feedback!

We’re pleased to announce the delivery of Kubernetes 1.16, our third release of 2019! Kubernetes 1.16 consists of 31 enhancements: 8 enhancements moving to stable, 8 enhancements in beta, and 15 enhancements in alpha.

The main themes of this release are:

• Custom resources: CRDs are in widespread use as a way to extend Kubernetes to persist and serve new resource types, and have been available in beta since the 1.7 release. The 1.16 release marks the graduation of CRDs to general availability (GA).
• Admission webhooks: Admission webhooks are in widespread use as a Kubernetes extensibility mechanism and have been available in beta since the 1.9 release. The 1.16 release marks the graduation of admission webhooks to general availability (GA).
• Overhauled metrics: Kubernetes has previously made extensive use of a global metrics registry to register metrics to be exposed. By implementing a metrics registry, metrics are registered in more transparent means. Previously, Kubernetes metrics have been excluded from any kind of stability requirements.
• Volume Extension: There are quite a few enhancements in this release that pertain to volumes and volume modifications. Volume resizing support in CSI specs is moving to beta which allows for any CSI spec volume plugin to be resizable.

• Topology Manager, a new Kubelet component, aims to co-ordinate resource assignment decisions to provide optimized resource allocations.
• IPv4/IPv6 dual-stack enables the allocation of both IPv4 and IPv6 addresses to Pods and Services.
• API Server Network Proxy going alpha in 1.16.
• Extensions for Cloud Controller Manager Migration.
• Continued deprecation of extensions/v1beta1, apps/v1beta1, and apps/v1beta2 APIs; these extensions will be retired in 1.16!

• The etcd and KMS plugin health checks are not exposed in the new livez and readyz endpoints. This will be fixed in 1.16.1.
• Systems running iptables 1.8.0 or newer should start it in legacy mode. Please note that this affects all versions of Kubernetes and not only v1.16.0. For more detailed information about the issue and how to apply a workaround, please refer to the official documentation
• Generating informers for packages in directories containing dots in their name is broken. This will be fixed in v1.16.1. (#82860)
• kube-scheduler won't be able to report scheduling Events if events.k8s.io/v1beta1 API is disabled. We are targeting the fix for v1.16.2 (#83203)
• The etcd client library vendored in v1.16 (github.com/coreos/etcd/clientv3) has a bug where IPv6 IP addresses get incorrectly trimmed to the first occurance of the : character. This affects all users of the client library including the kube-apiserver and kubeadm. We are targeting the fix for this bug in v1.16.3. (#83550)

• Container images tar files for amd64 will now contain the architecture in the RepoTags manifest.json section. If you are using docker manifests there are not visible changes. (#80266, @javier-b-perez)
• kubeadm now deletes the bootstrap-kubelet.conf file after TLS bootstrap User relying on bootstrap-kubelet.conf should switch to kubelet.conf that contains node credentials (#80676, @fabriziopandini)
• Node labels beta.kubernetes.io/metadata-proxy-ready, beta.kubernetes.io/metadata-proxy-ready and beta.kubernetes.io/kube-proxy-ds-ready are no longer added on new nodes.
  • ip-mask-agent addon starts to use the label node.kubernetes.io/masq-agent-ds-ready instead of beta.kubernetes.io/masq-agent-ds-ready as its node selector.
  • kube-proxy addon starts to use the label node.kubernetes.io/kube-proxy-ds-ready instead of beta.kubernetes.io/kube-proxy-ds-ready as its node selector.
  • metadata-proxy addon starts to use the label cloud.google.com/metadata-proxy-ready instead of beta.kubernetes.io/metadata-proxy-ready as its node selector.

• When PodInfoOnMount is enabled for a CSI driver, the new csi.storage.k8s.io/ephemeral parameter in the volume context allows a driver's NodePublishVolume implementation to determine on a case-by-case basis whether the volume is ephemeral or a normal persistent volume (#79983, @pohly)
• Add CSI Migration Shim for VerifyVolumesAreAttached and BulkVolumeVerify (#80443, @davidz627)
• Promotes VolumePVCDataSource (Cloning) feature to beta for 1.16 release (#81792, @j-griffith)
• Integrated volume limits for in-tree and CSI volumes into one scheduler predicate. (#77595, @bertinatto)

• API

  • The following APIs are no longer served by default:

    • All resources under apps/v1beta1 and apps/v1beta2 - use apps/v1 instead
    • daemonsets, deployments, replicasets resources under extensions/v1beta1 - use apps/v1 instead
    • networkpolicies resources under extensions/v1beta1 - use networking.k8s.io/v1 instead
    • podsecuritypolicies resources under extensions/v1beta1 - use policy/v1beta1 instead

    Serving these resources can be temporarily re-enabled using the --runtime-config apiserver flag.

    • apps/v1beta1=true
    • apps/v1beta2=true
    • extensions/v1beta1/daemonsets=true,extensions/v1beta1/deployments=true,extensions/v1beta1/replicasets=true,extensions/v1beta1/networkpolicies=true,extensions/v1beta1/podsecuritypolicies=true

    The ability to serve these resources will be completely removed in v1.18. (#70672, @liggitt)

  • Ingress resources will no longer be served from extensions/v1beta1 in v1.20. Migrate use to the networking.k8s.io/v1beta1 API, available since v1.14. Existing persisted data can be retrieved via the networking.k8s.io/v1beta1 API.

  • PriorityClass resources will no longer be served from scheduling.k8s.io/v1beta1 and scheduling.k8s.io/v1alpha1 in v1.17. Migrate to the scheduling.k8s.io/v1 API, available since v1.14. Existing persisted data can be retrieved via the scheduling.k8s.io/v1 API.

  • The export query parameter for list API calls, deprecated since v1.14, will be removed in v1.18.

  • The series.state field in the events.k8s.io/v1beta1 Event API is deprecated and will be removed in v1.18 (#75987, @yastij)

  • The apiextensions.k8s.io/v1beta1 version of CustomResourceDefinition is deprecated and will no longer be served in v1.19. Use apiextensions.k8s.io/v1 instead. (#79604, @liggitt)

  • The admissionregistration.k8s.io/v1beta1 versions of MutatingWebhookConfiguration and ValidatingWebhookConfiguration are deprecated and will no longer be served in v1.19. Use admissionregistration.k8s.io/v1 instead. (#79549, @liggitt)

  • The alpha metadata.initializers field, deprecated in 1.13, has been removed. (#79504, @yue9944882)

  • The deprecated node condition type OutOfDisk has been removed. Use the DiskPressure condition instead. (#72420, @Pingan2017)

  • The metadata.selfLink field is deprecated in individual and list objects. It will no longer be returned starting in v1.20, and the field will be removed entirely in v1.21. (#80978, @wojtek-t)

  • The deprecated cloud providers ovirt, cloudstack and photon have been removed (#72178, @dims)

  • The Cinder and ScaleIO volume providers have been deprecated and will be removed in a future release. (#80099, @dims)

  • The GA PodPriority feature gate is now on by default and cannot be disabled. The feature gate will be removed in v1.18. (#79262, @draveness)

  • Aggregated discovery requests can now timeout. Aggregated API servers must complete discovery calls within 5 seconds (other requests can take longer). Use the feature gate EnableAggregatedDiscoveryTimeout=false to temporarily revert behavior to the previous 30 second timeout if required (the temporary EnableAggregatedDiscoveryTimeout feature gate will be removed in v1.17). (#82146, @deads2k)

  • the scheduler.alpha.kubernetes.io/critical-pod annotation is removed. Pod priority (spec.priorityClassName) should be used instead to mark pods as critical. (#80342, @draveness)

  • the NormalizeScore plugin set is removed from scheduler framework config API. Use ScorePlugin only. (#80930, @liu-cong)

  • the node label alpha.service-controller.kubernetes.io/exclude-balancer which excludes a node from cloud load balancers (using Service Type=LoadBalancer) is deprecated in favor of node.kubernetes.io/exclude-balancer. Support for alpha.service-controller.kubernetes.io/exclude-balancer will be removed in v1.18.

• Features:

  • The following features are now GA, and the associated feature gates are deprecated and will be removed in v1.17:
    • GCERegionalPersistentDisk (since 1.15.0)
    • CustomResourcePublishOpenAPI
    • CustomResourceSubresources
    • CustomResourceValidation
    • CustomResourceWebhookConversion
  • The feature flags HugePages, VolumeScheduling, CustomPodDNS and PodReadinessGates have been removed (#79307, @draveness)

• hyperkube

  • the --make-symlinks flag, deprecated in v1.14, has been removed. (#80017, @Pothulapati)

• kube-apiserver

  • the --basic-auth-file flag and authentication mode is deprecated and will be removed in a future release. It is not recommended for production environments. (#81152, @tedyu)
  • the --cloud-provider-gce-lb-src-cidrs flag has been deprecated. This flag will be removed once the GCE Cloud Provider is removed from kube-apiserver. (#81094, @andrewsykim)
  • the --enable-logs-handler flag and log-serving functionality is deprecated since v1.15, and scheduled to be removed in v1.19. (#77611, @rohitsardesai83)
  • Deprecate the default service IP CIDR. The previous default was 10.0.0.0/24 which will be removed in 6 months/2 releases. Cluster admins must specify their own desired value, by using --service-cluster-ip-range on kube-apiserver. (#81668, @darshanime)

• kube-proxy

  • the --resource-container flag has been removed from kube-proxy, and specifying it will now cause an error. The behavior is now as if you specified --resource-container="". If you previously specified a non-empty --resource-container, you can no longer do so as of kubernetes 1.16. (#78294, @vllry)

• kube-scheduler

  • Migrate scheduler to use v1beta1 Event API. any tool targeting scheduler events needs to use v1beta1 Event API (#78447, @yastij)

• kubeadm

  • The CoreDNS Deployment now checks readiness via the ready plugin.
  • The proxy plugin has been deprecated. The forward plugin is to be used instead.
  • kubernetes plugin removes the resyncperiod option.
  • The upstream option is deprecated and ignored if included. (#82127, @rajansandeep)

• kubectl

  • kubectl convert, deprecated since v1.14, will be removed in v1.17.
  • The --export flag for the kubectl get command, deprecated since v1.14, will be removed in v1.18.
  • kubectl cp no longer supports copying symbolic links from containers; to support this use case, see kubectl exec --help for examples using tar directly (#82143, @soltysh)
  • Removed deprecated flag --include-uninitialized. (#80337, @draveness)

• kubelet

  • the --containerized flag was deprecated in 1.14 and has been removed (#80043, @dims)
  • the beta.kubernetes.io/os and beta.kubernetes.io/arch labels, deprecated since v1.14, are targeted for removal in v1.18.
  • cAdvisor json endpoints have been deprecated since 1.15. (#78504, @dashpole)
  • removed the ability to set kubernetes.io- or k8s.io-prefixed labels via --node-labels, other than the specifically allowed labels/prefixes. (#79305, @paivagustavo)

• client-go

  • Remove DirectCodecFactory (replaced with serializer.WithoutConversionCodecFactory), DirectEncoder (replaced with runtime.WithVersionEncoder) and DirectDecoder (replaced with runtime.WithoutVersionDecoder). (#79263, @draveness)

• Added metrics aggregator_openapi_v2_regeneration_count, aggregator_openapi_v2_regeneration_gauge and apiextension_openapi_v2_regeneration_count counting the triggering APIService and CRDs and the reason (add, update, delete) when kube-apiserver regenerates the OpenAPI spec. (#81786, @sttts)
• Added metrics authentication_attempts that can be used to understand the attempts of authentication. (#81509, @RainbowMango)
• Add a new counter metrics apiserver_admission_webhook_rejection_count with details about the causing for a webhook rejection. (#81399, @roycaihw)
• NFS Drivers are now enabled to collect metrics, StatFS metrics provider is used to collect the metrics. (@brahmaroutu) (#75805, @brahmaroutu)
• Add container_sockets, container_threads, and container_threads_max metrics (#81972, @dashpole)
• Add container_state label to running_container_count kubelet metrics, to get count of containers based on their state(running/exited/created/unknown) (#81573, @irajdeep)
• Added metric apiserver_watch_events_total that can be used to understand the number of watch events in the system. (#78732, @mborsz)
• Added metric apiserver_watch_events_sizes that can be used to estimate sizes of watch events in the system. (#80477, @mborsz)
• Added a new Prometheus counter metric sync_proxy_rules_iptables_restore_failures_total for kube-proxy iptables-restore failures (both ipvs and iptables modes) (#81210, @figo)
• kubelet now exports an kubelet_evictions metric that counts the number of pod evictions carried out by the kubelet to reclaim resources (#81377, @sjenning)

• Removed cadvisor metric labels pod_name and container_name to match instrumentation guidelines. Any Prometheus queries that match pod_name and container_name labels (e.g. cadvisor or kubelet probe metrics) must be updated to use pod and container instead. (#80376, @ehashman)

• kube-controller-manager and cloud-controller-manager metrics are now marked as with the ALPHA stability level. (#81624, @logicalhan)
• kube-proxy metrics are now marked as with the ALPHA stability level. (#81626, @logicalhan)
• kube-apiserver metrics are now marked as with the ALPHA stability level. (#81531, @logicalhan)
• kubelet metrics for /metrics and /metrics/probes are now marked as with the ALPHA stability level. (#81534, @logicalhan)
• Scheduler metrics are now marked as with the ALPHA stability level. (#81576, @logicalhan)
• The rejected label in apiserver_admission_webhook_admission_duration_seconds metrics now properly indicates if the request was rejected. (#81399, @roycaihw)
• Fixed a bug in the CSI metrics that does not return not supported error when a CSI driver does not support metrics. (#79851, @jparklab)
• Fix disk stats in LXD using ZFS storage pool and CRI-O missing network metris bug (#81972, @dashpole)

• Promote WatchBookmark feature to beta and enable it by default. With WatchBookmark feature, clients are able to request watch events with BOOKMARK type. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. (#79786, @wojtek-t)
• The server-side apply feature is now beta (#81956, @apelisse)
• Server-side apply will now use the openapi provided in the CRD validation field to help figure out how to correctly merge objects and update ownership. (#77354, @jennybuckley)
• The CustomResourceDefaulting feature is promoted to beta and enabled by default. Defaults may be specified in structural schemas via the apiextensions.k8s.io/v1 API. See https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/#specifying-a-structural-schema for details. (#81872, @sttts)
• Finalizer Protection for Service LoadBalancers is now in beta (enabled by default). This feature ensures the Service resource is not fully deleted until the correlating load balancer resources are deleted. (#81691, @MrHohn)
• Graduating Windows GMSA support from alpha to beta (#82110, @wk8)

• Introduce a new admission controller for RuntimeClass. Initially, RuntimeClass will be used to apply the pod overhead associated with a given RuntimeClass to the Pod spec if a corresponding RuntimeClassName is specified. PodOverhead is an alpha feature as of Kubernetes 1.16. (#78484, @egernst)
• Introduction of the pod overhead feature to the scheduler. This functionality is alpha-level as of Kubernetes v1.16, and is only honored by servers that enable the PodOverhead feature.gate. (#78319, @egernst)
• Ephemeral containers have been added in alpha. These temporary containers can be added to running pods for purposes such as debugging, similar to how kubectl exec runs a process in an existing container. Also like kubectl exec, no resources are reserved for ephemeral containers and they are not restarted when they exit. Note that container namespace targeting is not yet implemented, so process namespace sharing must be enabled to view process from other containers in the pod. (#59484, @verb)
• Pod spread constraints have been added in alpha. You can use these constraints to control how Pods are spread across the cluster among failure-domains. (#77327, #77760, #77828, #79062, #80011, #81068, @Huang-Wei)

• the new flag --endpoint-updates-batch-period in kube-controller-manager can be used to reduce the number of endpoints updates generated by pod changes. (#80509, @mborsz)
• the kubectl --all-namespaces flag is now honored by kubectl wait (#81468, @ashutoshgngwr)
• kubectl get -w now takes an --output-watch-events flag to indicate the event type (ADDED, MODIFIED, DELETED) (#72416, @liggitt)
• Adds Endpoint Slice support for kubectl when discovery API group is enabled. (#81795, @robscott)

• Add --shutdown-delay-duration to kube-apiserver in order to delay a graceful shutdown. /healthz will keep returning success during this time and requests are normally served, but /readyz will return failure immediately. This delay can be used to allow the SDN to update iptables on all nodes and stop sending traffic. (#74416, @sttts) Kubeadm now seamlessly migrates the CoreDNS Configuration when upgrading CoreDNS. (#78033, @rajansandeep)
• Add Endpoint Slice Controller for managing new EndpointSlice resource, disabled by default. (#81048, @robscott)
• Adds \livez for liveness health checking for kube-apiserver. Using the parameter --maximum-startup-sequence-duration will allow the liveness endpoint to defer boot-sequence failures for the specified duration period. (#81969, @logicalhan)
• Adds EndpointSlice integration to kube-proxy, can be enabled with EndpointSlice feature gate. (#81430, @robscott)
• Add status condition to namespace resource (#73405, @wozniakjan)
• Enhance Azure cloud provider code to support both AAD and ADFS authentication. (#80841, @rjaini)
• kubeadm: implement support for concurrent add/remove of stacked etcd members (#79677, @neolit123)
• kubeadm: support any Linux kernel version newer than 3.10 (#81623, @neolit123)
• Volume expansion is enabled in the default GCE storageclass (#78672, @msau42)
• kubeadm ClusterConfiguration now supports featureGates: IPv6DualStack: true (#80145, @Arvinderpal)
• In order to enable dual-stack support within kubeadm and kubernetes components, as part of the init config file, the user should set feature-gate IPv6DualStack=true in the ClusterConfiguration. Additionally, for each worker node, the user should set the feature-gate for kubelet using either nodeRegistration.kubeletExtraArgs or KUBELET_EXTRA_ARGS. (#80531, @Arvinderpal)
• Add possibility to configure controller manager to use IPv6 dual stack: use --cluster-cidr="<cidr1>,<cidr2>". Notes:
  1. Only the first two CIDRs are used (soft limits for Alpha, might be lifted later on).
  2. Only the "RangeAllocator" (default) is allowed as a value for --cidr-allocator-type. Cloud allocators are not compatible with IPv6 dual stack (#73977, @khenidak)
• Add scheduling support for RuntimeClasses. RuntimeClasses can now specify nodeSelector constraints & tolerations, which are merged into the PodSpec for pods using that RuntimeClass. (#80825, @tallclair)
• When specifying --(kube|system)-reserved-cgroup, with --cgroup-driver=systemd, it is now possible to use the fully qualified cgroupfs name (i.e. /test-cgroup.slice). (#78793, @mattjmcnaughton)
• Adds support for vSphere volumes on Windows (#80911, @gab-satchi)

• The MutatingWebhookConfiguration and ValidatingWebhookConfiguration APIs have been promoted to admissionregistration.k8s.io/v1:
  • failurePolicy default changed from Ignore to Fail for v1
  • matchPolicy default changed from Exact to Equivalent for v1
  • timeout default changed from 30s to 10s for v1
  • sideEffects default value is removed, and the field made required, and only None and NoneOnDryRun are permitted for v1
  • admissionReviewVersions default value is removed and the field made required for v1 (supported versions for AdmissionReview are v1 and v1beta1)
  • The name field for specified webhooks must be unique for MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects created via admissionregistration.k8s.io/v1
• The AdmissionReview API sent to and received from admission webhooks has been promoted to admission.k8s.io/v1. Webhooks can specify a preference for receiving v1 AdmissionReview objects with admissionReviewVersions: ["v1","v1beta1"], and must respond with an API object in the same apiVersion they are sent. When webhooks use admission.k8s.io/v1, the following additional validation is performed on their responses:
  • response.patch and response.patchType are not permitted from validating admission webhooks
  • apiVersion: "admission.k8s.io/v1" is required
  • kind: "AdmissionReview" is required
  • response.uid: "<value of request.uid>" is required
  • response.patchType: "JSONPatch" is required (if response.patch is set) (#80231, @liggitt)
• The CustomResourceDefinition API type is promoted to apiextensions.k8s.io/v1 with the following changes:
  • Use of the new default feature in validation schemas is limited to v1
  • spec.scope is no longer defaulted to Namespaced and must be explicitly specified
  • spec.version is removed in v1; use spec.versions instead
  • spec.validation is removed in v1; use spec.versions[*].schema instead
  • spec.subresources is removed in v1; use spec.versions[*].subresources instead
  • spec.additionalPrinterColumns is removed in v1; use spec.versions[*].additionalPrinterColumns instead
  • spec.conversion.webhookClientConfig is moved to spec.conversion.webhook.clientConfig in v1
  • spec.conversion.conversionReviewVersions is moved to spec.conversion.webhook.conversionReviewVersions in v1
  • spec.versions[*].schema.openAPIV3Schema is now required when creating v1 CustomResourceDefinitions
  • spec.preserveUnknownFields: true is disallowed when creating v1 CustomResourceDefinitions; it must be specified within schema definitions as x-kubernetes-preserve-unknown-fields: true
  • In additionalPrinterColumns items, the JSONPath field was renamed to jsonPath in v1 (fixes #66531) The apiextensions.k8s.io/v1beta1 version of CustomResourceDefinition is deprecated and will no longer be served in v1.19. (#79604, @liggitt)
• The ConversionReview API sent to and received from custom resource CustomResourceDefinition conversion webhooks has been promoted to apiextensions.k8s.io/v1. CustomResourceDefinition conversion webhooks can now indicate they support receiving and responding with ConversionReview API objects in the apiextensions.k8s.io/v1 version by including v1 in the conversionReviewVersions list in their CustomResourceDefinition. Conversion webhooks must respond with a ConversionReview object in the same apiVersion they receive. apiextensions.k8s.io/v1 ConversionReview responses must specify a response.uid that matches the request.uid of the object they were sent. (#81476, @liggitt)
• Add scheduling support for RuntimeClasses. RuntimeClasses can now specify nodeSelector constraints & tolerations, which are merged into the PodSpec for pods using that RuntimeClass. (#80825, @tallclair)
• Kubelet should now more reliably report the same primary node IP even if the set of node IPs reported by the CloudProvider changes. (#79391, @danwinship)
• Omit nil or empty field when calculating container hash value to avoid hash changed. For a new field with a non-nil default value in the container spec, the hash would still get changed. (#57741, @dixudx)
• Property conditions in apiextensions.v1beta1.CustomResourceDefinitionStatus and apiextensions.v1.CustomResourceDefinitionStatus is now optional instead of required. (#64996, @roycaihw)
• When the status of a CustomResourceDefinition condition changes, its corresponding lastTransitionTime is now updated. (#69655, @CaoShuFeng)

• Remove GetReference() and GetPartialReference() function from pkg/api/ref, as the same function exists also in staging/src/k8s.io/client-go/tools/ref (#80361, @wojtek-t)
• Verify that CRD default values in OpenAPI specs are pruned, with the exceptions of values under metadata. (#78829, @sttts)
• Fixes a bug that when there is a "connection refused" error, the reflector's ListAndWatch func will return directly but what expected is that sleep 1 second and rewatch since the specified resourceVersion. (#81634, @likakuli)
• Resolves an issue serving aggregated APIs backed by services that respond to requests to / with non-2xx HTTP responses (#79895, @deads2k)
• The CRD handler now properly re-creates stale CR storage to reflect CRD update. (#79114, @roycaihw)
• Fix CVE-2019-11247: API server allows access to custom resources via wrong scope (#80750, @sttts)
• Fixed a bug with the openAPI definition for io.k8s.apimachinery.pkg.runtime.RawExtension, which previously required a field raw to be specified (#80773, @jennybuckley)
• Property conditions in apiextensions.v1beta1.CustomResourceDefinitionStatus and apiextensions.v1.CustomResourceDefinitionStatus is now optional instead of required. (#64996, @roycaihw)
• Resolves a transient 404 response to custom resource requests during server startup (#81244, @liggitt)
• OpenAPI now advertises correctly supported patch types for custom resources (#81515, @liggitt)
• When the status of a CRD Condition changes, it's corresponding LastTransitionTime is now updated. (#69655, @CaoShuFeng)
• Add metadata.generation=1 to old CustomResources. (#82005, @sttts)
• Fix a bug in the apiserver that could cause a valid update request to be rejected with a precondition check failure. (#82303, @roycaihw)
• Fixes regression in logging spurious stack traces when proxied connections are closed by the backend (#82588, @liggitt)
• RateLimiter add a context-aware method, fix client-go request goruntine backlog in async timeout scene. (#79375, @answer1991)
• Add a Patch method to ScaleInterface (#80699, @knight42)
• CRDs under k8s.io and kubernetes.io must have the api-approved.kubernetes.io set to either unapproved.* or a link to the pull request approving the schema. See kubernetes/enhancements#1111 for more details. (#79992, @deads2k)
• KMS Providers will install a healthz check for the status of kms-plugin in kube-apiservers' encryption config. (#78540, @immutableT)
• Improves validation errors for custom resources (#81212, @liggitt)
• Populate object name for admission attributes when CREATE (#53185, @dixudx)
• Add Overhead field to the PodSpec and RuntimeClass types as part of the Pod Overhead KEP (#76968, @egernst)

• Fix a bug that pods not be deleted from unmatched nodes by daemon controller (#78974, @DaiHao)
• Fix a bug that causes DaemonSet rolling update hang when there exist failed pods. (#78170, @DaiHao)

• Service account tokens now include the JWT Key ID field in their header. (#78502, @ahmedtd)
• The nbf (not before) claim, if present in ID token, is now enforced. (#81413, @anderseknert)

• Fix CVE-2019-11249: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal (#80436, @M00nF1sh)
• Fix the bash completion error with override flags. (#80802, @dtaniwaki)
• Fix a bug in server printer that could cause kube-apiserver to panic. (#79349, @roycaihw)
• Fix invalid "time stamp is the future" error when kubectl cp-ing a file (#73982, @tanshanshan)
• Fix a bug where kubectl set config hangs and uses 100% CPU on some invalid property names (#79000, @pswica)
• Fix output of kubectl get --watch-only when watching a single resource (#79345, @liggitt)
• Make kubectl get --ignore-not-found continue processing when encountering error. (#82120, @soltysh)
• Correct a reference to a not/no longer used kustomize subcommand in the documentation (#82535, @demobox)
• kubectl could scale custom resource again (#81342, @knight42)
• Add PodOverhead awareness to kubectl (#81929, @egernst)

• When a load balancer type service is created in a k8s cluster that is backed by Azure Standard Load Balancer, the corresponding load balancer rule added in the Azure Standard Load Balancer would now have the "EnableTcpReset" property set to true. (#80624, @xuto2)
• Switch to VM Update call in attach/detach disk operation, original CreateOrUpdate call may lead to orphaned VMs or blocked resources (#81208, @andyzhangx)
• Fix azure disk naming matching issue due to case sensitive comparison (#81720, @andyzhangx)
• Fix retry issues when the nodes are under deleting on Azure (#80419, @feiskyer)
• Fix conflicted cache when the requests are canceled by other Azure operations. (#81282, @feiskyer)
• Fix make azure disk URI as case insensitive (#79020, @andyzhangx)
• Fix VMSS LoadBalancer backend pools so that the network won't be broken when instances are upgraded to latest model (#81411, @nilo19)
• Default resourceGroup should be used when the value of annotation azure-load-balancer-resource-group is an empty string. (#79514, @feiskyer)
• Kubelet could be run with no Azure identity without subscriptionId configured now. A sample cloud provider configure is: '{"vmType": "vmss", "useInstanceMetadata": true}'. (#81500, @feiskyer)
• Fix public IP not found issues for VMSS nodes (#80703, @feiskyer)
• Fix Azure client requests stuck issues on http.StatusTooManyRequests (HTTP Code 429). (#81279, @feiskyer)
• Add a service annotation service.beta.kubernetes.io/azure-pip-name to specify the public IP name for Azure load balancer. (#81213, @nilo19)
• Optimize EC2 DescribeInstances API calls in aws cloud provider library by querying instance ID instead of EC2 filters when possible (#78140, @zhan849)
• Creates an annotation service.beta.kubernetes.io/aws-load-balancer-eip-allocations to assign AWS EIP to the newly created Network Load Balancer. Number of allocations and subnets must match. (#69263, @brooksgarrett)
• Add an azure cloud configuration LoadBalancerName and LoadBalancerResourceGroup to allow the corresponding customizations of azure load balancer. (#81054, @nilo19)

• Fix error handling and potential go null pointer exception in kubeadm upgrade diff (#80648, @odinuge)

• kubeadm: fall back to client version in case of certain HTTP errors (#80024, @RainbowMango)

• kubeadm: fix a potential panic if kubeadm discovers an invalid, existing kubeconfig file (#79165, @neolit123)

• kubeadm: treat non-fatal errors as warnings when doing reset (#80862, @drpaneas)

• kubeadm: prevent PSP blocking of upgrade image prepull by using a non-root user (#77792, @neolit123)

• kubeadm: fix "certificate-authority" files not being pre-loaded when using file discovery (#80966, @neolit123)

• Add instruction to setup "Application Default Credentials" to run GCE Windows e2e tests locally. (#81337, @YangLu1031)

• Fix error in kubeadm join --discovery-file when using discovery files with embedded credentials (#80675, @fabriziopandini)

• Fix remove the etcd member from the cluster during a kubeadm reset. (#79326, @bradbeam)

• kubeadm: the permissions of generated CSR files are changed from 0644 to 0600 (#81217, @SataQiu)

• kubeadm: avoid double deletion of the upgrade prepull DaemonSet (#80798, @xlgao-zju)

• kubeadm: introduce deterministic ordering for the certificates generation in the phase command kubeadm init phase certs. (#78556, @neolit123)

• kubeadm: implement retry logic for certain ConfigMap failures when joining nodes (#78915, @ereslibre)

• kubeadm: use etcd's /health endpoint for a HTTP liveness probe on localhost instead of having a custom health check using etcdctl (#81385, @neolit123)

• kubeadm reset: unmount directories under /var/lib/kubelet for Linux only (#81494, @Klaven)

• kubeadm: fix the bug that --cri-socket flag does not work for kubeadm reset (#79498, @SataQiu)

• kubeadm: produce errors if they occur when resetting cluster status for a control-plane node (#80573, @bart0sh)

• Fix an error when using external etcd but storing etcd certificates in the same folder with the same name used by kubeadm for local etcd certificates; for an older version of kubeadm, the workaround is to avoid file name used by kubeadm for local etcd. (#80867, @fabriziopandini)

• kubeadm join fails if file-based discovery is too long, with a default timeout of 5 minutes. (#80804, @olivierlemasle)

• kubeadm: fixed ignoring errors when pulling control plane images (#80529, @bart0sh)

• Fix a bug in kube-addon-manager's leader election logic that made all replicas active. (#80575, @mborsz)

• kubeadm: prevent overriding of certain kubelet security configuration parameters if the user wished to modify them (#81903, @jfbai)

• kubeadm no longer performs IPVS checks as part of its preflight checks (#81791, @yastij)

• kubeadm: fix for HTTPProxy check for IPv6 addresses (#82267, @kad)

• kubeadm: Allow users to skip the kube-proxy init addon phase during init and still be able to join a cluster and perform some other minor operations (but not upgrade). (#82248, @rosti)

• Mounts /home/kubernetes/bin/nvidia/vulkan/icd.d on the host to /etc/vulkan/icd.d inside containers requesting GPU. (#78868, @chardch)

• kubeadm: use the --pod-network-cidr flag to init or use the podSubnet field in the kubeadm config to pass a comma separated list of pod CIDRs. (#79033, @Arvinderpal)

• kubeadm: provide --control-plane-endpoint flag for controlPlaneEndpoint (#79270, @SataQiu)

• kubeadm: enable secure serving for the kube-scheduler (#80951, @neolit123)

• kubeadm: print the stack trace of an error for klog level --v>=5 (#80937, @neolit123)

• Add --kubernetes-version to kubeadm init phase certs ca and kubeadm init phase kubeconfig (#80115, @gyuho)

• kubeadm: support fetching configuration from the original cluster for upgrade diff (#80025, @SataQiu)

• When using the conformance test image, a new environment variable E2E_USE_GO_RUNNER will cause the tests to be run with the new golang-based test runner rather than the current bash wrapper. (#79284, @johnSchnake)

• Implement a new feature that allows applying kustomize patches to static pod manifests generated by kubeadm. (#80905, @fabriziopandini)

• The 404 request handler for the GCE Ingress load balancer now exports prometheus metrics, including:

  • http_404_request_total (the number of 404 requests handled)
  • http_404_request_duration_ms (the amount of time the server took to respond in ms)

  Also includes percentile groupings. The directory for the default 404 handler includes instructions on how to enable prometheus for monitoring and setting alerts. (#79106, @vbannai)

• Kibana has been slightly revamped/improved in the latest version (#80421, @lostick)

• Fix a string comparison bug in IPVS graceful termination where UDP real servers are not deleted. (#78999, @andrewsykim)
• kube-proxy --cleanup will return the correct exit code if the cleanup was successful (#78775, @johscheuer)
• Fix a bug in the IPVS proxier where virtual servers are not cleaned up even though the corresponding Service object was deleted. (#80942, @gongguan)
• kube-proxy waits for some duration for the node to be defined. (#77167, @paulsubrata55)
• Increase log level for graceful termination to v=5 (#80100, @andrewsykim)
• Reduce kube-proxy CPU usage in IPVS mode when a large number of nodePort services exist. (#79444, @cezarsa)
• Fix in kube-proxy for SCTP nodeport service which only works for node's InternalIP, but doesn't work for other IPs present in the node when ipvs is enabled. (#81477, @paulsubrata55)
• Ensure the KUBE-MARK-DROP chain in kube-proxy IPVS mode. The chain is ensured for both IPv4 and IPv6 in dual-stack operation. (#82214, @uablrek)
• Introduce node.kubernetes.io/exclude-balancer and node.kubernetes.io/exclude-disruption labels in alpha to prevent cluster deployers from being dependent on the optional node-role labels which not all clusters may provide. (#80238, @smarterclayton)
• If targetPort is changed that will process by service controller (#77712, @Sn0rt)

• Remove PIDs cgroup controller requirement when related feature gates are disabled (#79073, @rafatio)
• Fix kubelet NodeLease potential performance issues. Kubelet now will try to update lease using cached one instead of get from API Server every time. (#81174, @answer1991)
• Passing an invalid policy name in the --cpu-manager-policy flag will now cause the kubelet to fail instead of simply ignoring the flag and running the cpumanager’s default policy instead. (#80294, @klueska)
• Make node lease renew interval more heuristic based on node-status-update-frequency in kubelet (#80173, @gaorong)
• Kubelet should now more reliably report the same primary node IP even if the set of node IPs reported by the CloudProvider changes. (#79391, @danwinship)
• Omit nil or empty field when calculating container hash value to avoid hash changed. For a new field with a non-nil default value in the container spec, the hash would still get changed. (#57741, @dixudx)
• Fix a bug where kubelet would not retry pod sandbox creation when the restart policy of the pod is Never (#79451, @yujuhong)
• Limit the body length of exec readiness/liveness probes. remote CRIs and Docker shim read a max of 16MB output of which the exec probe itself inspects 10kb. (#82514, @dims)
• Single static pod files and pod files from http endpoints cannot be larger than 10 MB. HTTP probe payloads are now truncated to 10KB. (#82669, @rphillips)
• Introduce support for applying pod overhead to pod cgroups, if the PodOverhead feature is enabled. (#79247, @egernst)
• Node-Problem-Detector v0.7.1 is used on GCI (#80726, @wangzhen127)
• Node-Problem-Detector v0.7.1 is used for addon daemonset. (#82140, @wangzhen127)
• Enable cAdvisor ProcessMetrics collecting. (#79002, @jiayingz)
• kubelet: change node-lease-renew-interval to 0.25 of lease-renew-duration (#80429, @gaorong)
• Attempt to set the kubelet's hostname & internal IP if --cloud-provider=external and no node addresses exists (#75229, @andrewsykim)

• Scheduler should terminate when it loses leader lock. (#81306, @ravisantoshgudimetla)
• If scheduler extender filtered a not found node, current scheduling round for this pod will just be skipped. (#79641, @yqwang-ms)
• Extender bind should respect IsInterested (#79804, @yqwang-ms)
• Fix an issue with toleration merging & whitelist checking in the PodTolerationRestriction admission controller. (#81732, @tallclair)
• Add a helper function to decode scheduler plugin args. (#80696, @hex108)
• Fix filter plugins are not been called during preemption (#81876, @wgliang)
• Fix an issue that the correct PluginConfig.Args is not passed to the corresponding PluginFactory in kube-scheduler when multiple PluginConfig items are defined. (#82483, @everpeace)
• Take the context as the first argument of Schedule. (#82119, @wgliang)
• Implement post-filter extension point for scheduling framework (#78097, @draveness)
• Add Bind extension point of the scheduling framework (#78513, @chenchun)
• Add Filter extension point to the scheduling framework. (#78477, @YoubingLi)
• Return error when the scoring plugin returns score out of range [0, 100]. (#81015, @draveness)
• Use a named array instead of a score array in normalizing-score phase. (#80901, @draveness)
• Updates the requestedToCapacityRatioArguments to add resources parameter that allows the users to specify the resource name along with weights for each resource to score nodes based on the request to capacity ratio. (#77688, @sudeshsh)
• Add UnschedulableAndUnresolvable status code for scheduling framework (#82034, @alculquicondor)
• Add normalize plugin extension point for the scheduling framework. (#80383, @liu-cong)
• Add Bind extension point to the scheduling framework. (#79313, @chenchun)
• Add Score extension point to the scheduling framework. (#79109, @ahg-g)
• Add Pre-filter extension point to the scheduling framework. (#78005, @ahg-g)
• Add support for writing out of tree custom scheduler plugins. (#78162, @hex108)

• Fix possible file descriptor leak and closing of dirs in doSafeMakeDir (#79534, @odinuge)
• Azure disks of shared kind will no longer fail if they do not contain skuname or storageaccounttype. (#80837, @rmweir)
• Fix CSI plugin supporting raw block that does not need attach mounted failed (#79920, @cwdsuzhou)
• Reduces GCE PD Node Attach Limits by 1 since the node boot disk is considered an attachable disk (#80923, @davidz627)
• Remove iSCSI volume storage cleartext secrets in logs (#81215, @zouyee)
• Fixes validation of VolumeAttachment API objects created with inline volume sources. (#80945, @tedyu)
• Changes timeout value in csi plugin from 15s to 2min which fixes the timeout issue (#79529, @andyzhangx)
• Fix kubelet fail to delete orphaned pod directory when the kubelet's pods directory (default is /var/lib/kubelet/pods) symbolically links to another disk device's directory (#79094, @gaorong)

• Fix pod list return value of framework.WaitForPodsWithLabelRunningReady (#78687, @pohly)
• Adding TerminationGracePeriodSeconds to the test framework API (#82170, @vivekbagade)
• /test/e2e/framework: Adds a flag non-blocking-taints which allows tests to run in environments with tainted nodes. String value should be a comma-separated list. (#81043, @johnSchnake)
• Move CSI volume expansion to beta. (#81467, @bertinatto)
• Added E2E tests validating WindowsOptions.RunAsUserName. (#79539, @bclau)
• framework.ExpectNoError no longer logs the error and instead relies on using the new log.Fail as gomega fail handler. (#80253, @pohly)

• On Windows systems, %USERPROFILE% is now preferred over %HOMEDRIVE%\%HOMEPATH% as the home folder if %HOMEDRIVE%\%HOMEPATH% does not contain a .kube\config file, and %USERPROFILE% exists and is writable. (#73923, @liggitt)
• Add support for AWS EBS on windows (#79552, @wongma7)
• Support Kubelet plugin watcher on Windows nodes. (#81397, @ddebroy)

• the default Go version was updated to v1.12.9. (#78958, #79966, #81390, #81489)
• etcd has been updated to v3.3.15 (#82199, @dims)
• CoreDNS for kubeadm and kube-up has been updated to v1.6.2 (#82127)
• Cluster Autoscaler has been updated to v1.16.0 (#82501, @losipiuk)
• fluentd has been updated to v1.5.1 (#79014)
• fluentd-elasticsearch plugin has been updated to v3.5.3 (#79014)
• elasticsearch has been updated to v7.1.1 (#79014)
• kibana has been updated to v7.1.1 (#79014)
• Azure SDK and go-autorest API versions have been updated (#79574)
• Azure API versions have been updated (container registry to 2018-09-01, network to 2018-08-01) (#79583)
• kube-addon-manager has been updated to v9.0.2 (#80861)
• golang/x/net has been updated to bring in fixes for CVE-2019-9512, CVE-2019-9514 (#81394)
• GCE windows node image has been updated. (#81106)
• portworx plugin has been updated on libopenstorage/openstorage to v1.0.0 (#80495)
• metrics-server has been updated to v0.3.4 (#82322, @olagacek)
• klog has been updated to v0.4.0 (#81164)

• The list of validated docker versions remains unchanged.
  • The current list is 1.13.1, 17.03, 17.06, 17.09, 18.06, 18.09. (#72823, #72831)
• CNI remains unchanged at v0.7.5. (#75455)
• cri-tools remains unchanged at v1.14.0. (#75658)
• CAdvisor remains unchanged at v0.33.2. (#76291)
• event-exporter remains unchanged at v0.2.5. (#77815)
• ip-masq-agent remains unchanged at v2.4.1. (#77844)
• k8s-dns-node-cache remains unchanged at v1.15.1 (#76640, @george-angel)
• CSI remains unchanged at to v1.1.0. (#75391)
• The dashboard add-on remains unchanged at v1.10.1. (#72495)
• kube-dns is unchanged at v1.14.13 as of Kubernetes 1.12. (#68900)
• Influxdb is unchanged at v1.3.3 as of Kubernetes 1.10. (#53319)
• Grafana is unchanged at v4.4.3 as of Kubernetes 1.10. (#53319)
• The fluent-plugin-kubernetes_metadata_filter plugin in fluentd-elasticsearch is unchanged at v2.1.6. (#71180)
• fluentd-gcp is unchanged at v3.2.0 as of Kubernetes 1.13. (#70954)
• OIDC authentication is unchanged at coreos/go-oidc v2 as of Kubernetes 1.10. (#58544)
• Calico is unchanged at v3.3.1 as of Kubernetes 1.13. (#70932)
• GLBC remains unchanged at v1.2.3 as of Kubernetes 1.12. (#66793)
• Ingress-gce remains unchanged at v1.2.3 as of Kubernetes 1.12. (#66793)

• Remove deprecated github.com/kardianos/osext dependency (#80142)

• github.com/Azure/go-autorest/autorest/adal: v0.5.0
• github.com/Azure/go-autorest/autorest/date: v0.1.0
• github.com/Azure/go-autorest/autorest/mocks: v0.2.0
• github.com/Azure/go-autorest/autorest/to: v0.2.0
• github.com/Azure/go-autorest/autorest/validation: v0.1.0
• github.com/Azure/go-autorest/autorest: v0.9.0
• github.com/Azure/go-autorest/logger: v0.1.0
• github.com/Azure/go-autorest/tracing: v0.5.0
• github.com/armon/consul-api: eb2c6b5
• github.com/bifurcation/mint: 93c51c6
• github.com/caddyserver/caddy: v1.0.3
• github.com/cenkalti/backoff: v2.1.1+incompatible
• github.com/checkpoint-restore/go-criu: bdb7599
• github.com/cheekybits/genny: 9127e81
• github.com/coredns/corefile-migration: v1.0.2
• github.com/coreos/go-etcd: v2.0.0+incompatible
• github.com/dustin/go-humanize: v1.0.0
• github.com/fatih/color: v1.6.0
• github.com/flynn/go-shlex: 3f9db97
• github.com/go-acme/lego: v2.5.0+incompatible
• github.com/go-bindata/go-bindata: v3.1.1+incompatible
• github.com/go-logr/logr: v0.1.0
• github.com/google/martian: v2.1.0+incompatible
• github.com/google/pprof: 3ea8567
• github.com/google/renameio: v0.1.0
• github.com/googleapis/gax-go/v2: v2.0.4
• github.com/hashicorp/go-syslog: v1.0.0
• github.com/jimstudt/http-authentication: 3eca13d
• github.com/kisielk/errcheck: v1.2.0
• github.com/kisielk/gotool: v1.0.0
• github.com/klauspost/cpuid: v1.2.0
• github.com/kr/pty: v1.1.5
• github.com/kylelemons/godebug: d65d576
• github.com/lucas-clemente/aes12: cd47fb3
• github.com/lucas-clemente/quic-clients: v0.1.0
• github.com/lucas-clemente/quic-go-certificates: d2f8652
• github.com/lucas-clemente/quic-go: v0.10.2
• github.com/marten-seemann/qtls: v0.2.3
• github.com/mattn/go-colorable: v0.0.9
• github.com/mattn/go-isatty: v0.0.3
• github.com/mholt/certmagic: 6a42ef9
• github.com/mitchellh/go-homedir: v1.1.0
• github.com/naoina/go-stringutil: v0.1.0
• github.com/naoina/toml: v0.1.1
• github.com/rogpeppe/go-internal: v1.3.0
• github.com/thecodeteam/goscaleio: v0.1.0
• github.com/ugorji/go/codec: d75b2dc
• github.com/xordataexchange/crypt: b2862e3
• go.opencensus.io: v0.21.0
• golang.org/x/mod: 4bf6d31
• gopkg.in/airbrake/gobrake.v2: v2.0.9
• gopkg.in/errgo.v2: v2.1.0
• gopkg.in/gemnasium/logrus-airbrake-hook.v2: v2.1.2
• gopkg.in/mcuadros/go-syslog.v2: v2.2.1
• gotest.tools/gotestsum: v0.3.5
• honnef.co/go/tools: v0.0.1-2019.2.2

• cloud.google.com/go: v0.34.0 → v0.38.0
• github.com/Azure/azure-sdk-for-go: v21.4.0+incompatible → v32.5.0+incompatible
• github.com/BurntSushi/toml: v0.3.0 → v0.3.1
• github.com/GoogleCloudPlatform/k8s-cloud-provider: f8e9959 → 27a4ced
• github.com/PuerkitoBio/purell: v1.1.0 → v1.1.1
• github.com/asaskevich/govalidator: f9ffefc → f61b66f
• github.com/client9/misspell: 9ce5d97 → v0.3.4
• github.com/containernetworking/cni: v0.6.0 → v0.7.1
• github.com/coreos/etcd: v3.3.13+incompatible → v3.3.15+incompatible
• github.com/coreos/go-oidc: 065b426 → v2.1.0+incompatible
• github.com/coreos/go-semver: e214231 → v0.3.0
• github.com/cpuguy83/go-md2man: v1.0.4 → v1.0.10
• github.com/cyphar/filepath-securejoin: ae69057 → v0.2.2
• github.com/dgrijalva/jwt-go: 01aeca5 → v3.2.0+incompatible
• github.com/docker/distribution: edc3ab2 → v2.7.1+incompatible
• github.com/emicklei/go-restful: ff4f55a → v2.9.5+incompatible
• github.com/evanphx/json-patch: 5858425 → v4.2.0+incompatible
• github.com/fatih/camelcase: f6a740d → v1.0.0
• github.com/go-openapi/analysis: v0.17.2 → v0.19.2
• github.com/go-openapi/errors: v0.17.2 → v0.19.2
• github.com/go-openapi/jsonpointer: v0.19.0 → v0.19.2
• github.com/go-openapi/jsonreference: v0.19.0 → v0.19.2
• github.com/go-openapi/loads: v0.17.2 → v0.19.2
• github.com/go-openapi/runtime: v0.17.2 → v0.19.0
• github.com/go-openapi/spec: v0.17.2 → v0.19.2
• github.com/go-openapi/strfmt: v0.17.0 → v0.19.0
• github.com/go-openapi/swag: v0.17.2 → v0.19.2
• github.com/go-openapi/validate: v0.18.0 → v0.19.2
• github.com/godbus/dbus: c7fdd8b → v4.1.0+incompatible
• github.com/gogo/protobuf: 342cbe0 → 65acae2
• github.com/golang/mock: bd3c8e8 → v1.2.0
• github.com/golang/protobuf: v1.2.0 → v1.3.1
• github.com/google/btree: 7d79101 → 4030bb1
• github.com/google/cadvisor: 9db8c7d → v0.34.0
• github.com/google/gofuzz: 24818f7 → v1.0.0
• github.com/google/uuid: v1.0.0 → v1.1.1
• github.com/gophercloud/gophercloud: c818fa6 → v0.1.0
• github.com/gorilla/websocket: 4201258 → v1.4.0
• github.com/grpc-ecosystem/go-grpc-prometheus: 2500245 → v1.2.0
• github.com/hashicorp/golang-lru: v0.5.0 → v0.5.1
• github.com/hashicorp/hcl: d8c773c → v1.0.0
• github.com/heketi/heketi: 558b292 → v9.0.0+incompatible
• github.com/jonboulle/clockwork: 72f9bd7 → v0.1.0
• github.com/json-iterator/go: ab8a2e0 → v1.1.7
• github.com/kr/pretty: f31442d → v0.1.0
• github.com/kr/text: 6807e77 → v0.1.0
• github.com/libopenstorage/openstorage: 093a0c3 → v1.0.0
• github.com/magiconair/properties: 61b492c → v1.8.1
• github.com/mailru/easyjson: 60711f1 → 94de47d
• github.com/mattn/go-shellwords: f8471b0 → v1.0.5
• github.com/miekg/dns: 5d001d0 → v1.1.4
• github.com/mistifyio/go-zfs: 1b4ae6f → v2.1.1+incompatible
• github.com/mitchellh/go-wordwrap: ad45545 → v1.0.0
• github.com/mvdan/xurls: 1b768d7 → v1.1.0
• github.com/onsi/ginkgo: v1.6.0 → v1.8.0
• github.com/onsi/gomega: 5533ce8 → v1.5.0
• github.com/opencontainers/go-digest: a6d0ee4 → v1.0.0-rc1
• github.com/opencontainers/image-spec: 372ad78 → v1.0.1
• github.com/opencontainers/runc: f000fe1 → 6cc5158
• github.com/opencontainers/selinux: 4a2974b → v1.2.2
• github.com/robfig/cron: df38d32 → v1.1.0
• github.com/russross/blackfriday: 300106c → v1.5.2
• github.com/seccomp/libseccomp-golang: 1b506fc → v0.9.1
• github.com/sirupsen/logrus: v1.2.0 → v1.4.2
• github.com/spf13/afero: b28a7ef → v1.2.2
• github.com/spf13/cast: e31f36f → v1.3.0
• github.com/spf13/cobra: c439c4f → v0.0.5
• github.com/spf13/jwalterweatherman: 33c24e7 → v1.1.0
• github.com/spf13/pflag: v1.0.1 → v1.0.3
• github.com/spf13/viper: 7fb2782 → v1.3.2
• github.com/stretchr/objx: v0.1.1 → v0.2.0
• github.com/stretchr/testify: v1.2.2 → v1.3.0
• golang.org/x/net: 65e2d4e → cdfb69a
• golang.org/x/tools: aa82965 → 6e04913
• google.golang.org/api: 583d854 → 5213b80
• google.golang.org/genproto: 09f6ed2 → 54afdca
• google.golang.org/grpc: v1.13.0 → v1.23.0
• gopkg.in/check.v1: 20d25e2 → 788fd78
• gopkg.in/natefinch/lumberjack.v2: 20b71e5 → v2.0.0
• gopkg.in/square/go-jose.v2: 89060de → v2.2.2
• gopkg.in/yaml.v2: v2.2.1 → v2.2.2
• k8s.io/gengo: f8a0810 → 26a6646
• k8s.io/klog: v0.3.1 → v0.4.0
• k8s.io/kube-openapi: b3a7cee → 743ec37
• k8s.io/utils: c2654d5 → 581e001
• sigs.k8s.io/structured-merge-diff: e85c7b2 → 6149e45

• github.com/Azure/go-autorest: v11.1.2+incompatible
• github.com/codedellemc/goscaleio: 20e2ce2
• github.com/d2g/dhcp4: a1d1b6c
• github.com/d2g/dhcp4client: 6e570ed
• github.com/jteeuwen/go-bindata: a0ff256
• github.com/kardianos/osext: 8fef92e
• github.com/kr/fs: 2788f0d
• github.com/marstr/guid: 8bdf7d1
• github.com/mholt/caddy: 2de4950
• github.com/natefinch/lumberjack: v2.0.0+incompatible
• github.com/pkg/sftp: 4d0e916
• github.com/shurcooL/sanitized_anchor_name: 10ef21a
• github.com/sigma/go-inotify: c87b6cf
• github.com/vmware/photon-controller-go-sdk: 4a435da
• github.com/xanzy/go-cloudstack: 1e2cbf6
• gopkg.in/yaml.v1: 9f9df34
• v1.16.0-rc.2
• v1.16.0-rc.1
• v1.16.0-beta.2
• v1.16.0-beta.1
• v1.16.0-alpha.3
• v1.16.0-alpha.2
• v1.16.0-alpha.1

Documentation

• Single static pod files and pod files from http endpoints cannot be larger than 10 MB. HTTP probe payloads are now truncated to 10KB. (#82669, @rphillips)
• Restores compatibility with <=1.15.x custom resources by not publishing OpenAPI for non-structural custom resource definitions (#82653, @liggitt)
• Fixes regression in logging spurious stack traces when proxied connections are closed by the backend (#82588, @liggitt)

Documentation

• Update Cluster Autoscaler to 1.16.0; changelog: https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-1.16.0 (#82501, @losipiuk)
• Resolved regression serving custom resources with unhandled validation schemas with the ServerSideApply feature enabled (#82438, @liggitt)
• Fix filter plugins are not been called during preemption (#81876, @wgliang)
• Fix the dns suffix search list for GCE window clusters. (#82314, @lzang)
• Install and start logging agent based on kube env ENABLE_NODE_LOGGING. (#81300, @liyanhui1228)
• kubeadm: Allow users to skip the kube-proxy init addon phase during init and still be able to join a cluster and perform some other minor operations (but not upgrade). (#82248, @rosti)
• Bump metrics-server to v0.3.4 (#82322, @olagacek)
• Updated default etcd service used by kubernetes to 3.3.15 (#82199, @dims)

Documentation

• Fix a bug in apiserver that could cause a valid update request to be rejected with a precondition check failure. (#82303, @roycaihw)
• Webhook client credentials configured with --admission-control-config-file must include non-default ports in the configured hostnames. For example, a webhook configured to speak to port 8443 on service mysvc in namespace myns would specify client credentials in a stanza with name: mysvc.myns.svc:8443. See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#authenticate-apiservers for more details. (#82252, @liggitt)
• Ensure the KUBE-MARK-DROP chain in kube-proxy mode=ipvs. The chain is ensured for both ipv4 and ipv6 in dual-stack operation. (#82214, @uablrek)
• kubectl cp no longer supports copying symbolic links from containers; to support this use case, see kubectl exec --help for examples using tar directly (#82143, @soltysh)
• kubeadm: fix for HTTPProxy check for IPv6 addresses (kubernetes/kubeadm#1769) (#82267, @kad)
• Add PodOverhead awareness to kubectl (#81929, @egernst)
• The nbf (not before) claim, if present in ID token, is now enforced. (#81413, @anderseknert)
• Server-side apply will now use the openapi provided in the CRD validation field to help figure out how to correctly merge objects and update ownership. (#77354, @jennybuckley)
• • Fix disk stats in LXD using ZFS storage pool (#81972, @dashpole)
    • • Fix CRI-O missing network metris bug
    • • Add container_sockets, container_threads, and container_threads_max metrics
• Adds Endpoint Slice support for kubectl when discovery API group is enabled. (#81795, @robscott)
• Node-Problem-Detector v0.7.1 is used for addon daemonset. (#82140, @wangzhen127)
• aggregated discovery requests can now timeout. Aggregated apiserver must complete discovery calls within five seconds. Other requests can take longer. (#82146, @deads2k)
  • Use feature gate EnableAggregatedDiscoveryTimeout=false if you must remove this check, but that feature gate will be removed next release.
• Graduating Windows GMSA support from alpha to beta (#82110, @wk8)
• Add UnschedulableAndUnresolvable status code for Scheduler Framework (#82034, @alculquicondor)
• Kubeadm now includes CoreDNS version 1.6.2 (#82127, @rajansandeep)

  • - The CoreDNS Deployment now checks readiness via the `ready` plugin.
    

  • - The `proxy` plugin has been deprecated. The `forward` plugin is to be used instead.
    

  • - `kubernetes` plugin removes the `resyncperiod` option.
    

  • - The `upstream` option is deprecated and ignored if included.
    

• Make kubectl get --ignore-not-found continue processing when encountering error. (#82120, @soltysh)
• Dual stack services (Phase II of IPv6DualStack feature) are enabled via the IPVS proxier. iptables proxier does not support dualstack yet. Dualstack iptables proxier is WIP and should catchup soon. (#82091, @khenidak)
  • to enable, kube-proxy must be have the following flags:
  • --proxy-mode=ipvs
  • --cluster-cidrs=,
• The apiserver now uses http/1.1 to communicate with admission webhooks, opening multiple connections to satisfy concurrent requests, and allowing spreading requests across multiple backing pods. (#82090, @liggitt)
• Added support to specify a global-access annotation for gce ILB. (#81549, @prameshj)
• Added new startupProbe, related to KEP kubernetes/enhancements#950. (#77807, @matthyx)
• Adds \livez for liveness health checking for kube-apiserver. Using the parameter --maximum-startup-sequence-duration will allow the liveness endpoint to defer boot-sequence failures for the specified duration period. (#81969, @logicalhan)
• Server-side apply is now Beta. (#81956, @apelisse)
• The rejected label in apiserver_admission_webhook_admission_duration_seconds metrics now properly indicates if a request was rejected. Add a new counter metrics apiserver_admission_webhook_rejection_count with details about the causing for a webhook rejection. (#81399, @roycaihw)
• Add container_state label to running_container_count kubelet metrics, to get count of containers based on their state(running/exited/created/unknown) (#81573, @irajdeep)
• Fix a bug in CRD openapi controller that user-defined CRD can overwrite OpenAPI definition/path for the CRD API. (#81436, @roycaihw)
• Service account tokens now include the JWT Key ID field in their header. (#78502, @ahmedtd)
• Adds EndpointSlice integration to kube-proxy, can be enabled with EndpointSlice feature gate. (#81430, @robscott)
• Azure supports IPv6 only on ELB not ILB. The cloud provider will return an error if the service is internal and is IPv6. (#80485, @khenidak)
  • Notes on LB name:
  • to ensure backword and forward compat:
  • • SingleStack -v4 (pre v1.16) => BackendPool name == clusterName
  • • SingleStack -v6 => BackendPool name == clusterName (all cluster bootstrap uses this name)
  • DualStack:
  • => IPv4 BackendPool name == clusterName
  • => IPv6 BackendPool name == -IPv6
  • This result into:
  • • clusters moving from IPv4 to duakstack will require no changes
  • • clusters moving from IPv6 (while not seen in the wild, we can not rule out their existence) to dualstack will require deleting backend pools (the reconciler will take care of creating correct backendpools)
• Promotes VolumePVCDataSource (Cloning) feature to beta for 1.16 release (#81792, @j-griffith)
• Remove kubectl log, use kubectl logs instead (#78098, @soltysh)
• CSI ephemeral inline volume support is beta, i.e. the CSIInlineVolume feature gate is enabled by default (#82004, @pohly)
• kubectl: the --all-namespaces flag is now honored by kubectl wait (#81468, @ashutoshgngwr)
• Kube-proxy metrics are now marked as with the ALPHA stability level. (#81626, @logicalhan)
• Kube-controller-manager and cloud-controller-manager metrics are now marked as with the ALPHA stability level. (#81624, @logicalhan)
• Adds Endpoint Slice Controller for managing new EndpointSlice resource, disabled by default. (#81048, @robscott)
• • to run: (#79386, @khenidak)
    • Master: convert service CIDR to list --service-cluster-ip-range=<CIDR>,<CIDR> and make sure IPv6DualStack feature flag is turned on. The flag is validated and used as the following:
    • 1. --service-cluster-ip-range[0] is consider primary service range, and will be used for any service with Service.Spec.IPFamily = nil or any service in the at the time of turning on the feature flag.
    • 2. A cluster can be dualstack (i.e. Pods and nodes carry dualstack IPs) but does not need to support ingress on dualstack. In this case the cluster can perform egress using PodIPs (according to family and binding selection in user code) but will ingress will only be performed against the pod primary IP. This can be configured by supplying single entry to --service-cluster-ip-range flag.
    • 3. Maximum of two entries is allowed in --service-cluster-ip-range and they are validated to be dual stacked i.e. --service-cluster-ip-range=<v4>,<v6> or --service-cluster-ip-range=<v6>,<v4>
    • 4. Max 20 bit for range (min network bits <v6>/108 or /12)
    • kube-controller-manager: convert service CIDR to list --service-cluster-ip-range=<CIDR>,<CIDR> and make sure IPv6DualStack feature flag is turned on. The flag is validated as above.
    • • to use:
    • A new service spec field Service.Spec.IPFamily has been added. The default of this field is family of (first service cidr in --service-cluster-ip-range flag). The value is defaulted as described above once the feature gate is turned on. Here are the possible values for this field:
    • 2. IPv4: api-server will assign an IP from a service-cluster-ip-range that is ipv4 (either the primary or the secondary, according to how they were configured).
    • 2. IPv6: api-server will assign an IP from a service-cluster-ip-range that is ipv6 (either the primary or the secondary, according to how they were configured).
    • Notes (v1.16):
    • 1. IPVS is the only proxy supported (as of v1.16 ) by Dualstack.
    • 2. Dualstack is mutually exclusive with EndpointSlice feature. They can not be turned on together. metaproxy is yet to implement EndpointSlice handling.
• Kubelet metrics for /metrics and /metrics/probes are now marked as with the ALPHA stability level. (#81534, @logicalhan)
• Added metrics 'authentication_attempts' that can be used to understand the attempts of authentication. (#81509, @RainbowMango)
• Fix in kube-proxy for SCTP nodeport service which only works for node's InternalIP, but doesn't work for other IPs present in the node when ipvs is enabled. (#81477, @paulsubrata55)
• The CustomResourceValidation, CustomResourceSubresources, CustomResourceWebhookConversion and CustomResourcePublishOpenAPI features are now GA, and the associated feature gates deprecated and will be removed in v1.18. (#81965, @roycaihw)
• Node-Problem-Detector v0.7.1 is used on GCI. (#80726, @wangzhen127)
• kubeadm: prevent overriding of certain kubelet security configuration parameters if the user wished to modify them (#81903, @jfbai)
• Introduce node.kubernetes.io/exclude-balancer and node.kubernetes.io/exclude-disruption labels in alpha to prevent cluster deployers from being dependent on the optional node-role labels which not all clusters may provide. (#80238, @smarterclayton)
• Scheduler metrics are now marked as with the ALPHA stability level. (#81576, @logicalhan)
• cache-control headers are now set appropriately. Only openapi is cacheable if etags match. (#81946, @deads2k)
• Added E2E tests validating WindowsOptions.RunAsUserName. (#79539, @bclau)
• Kube-apiserver metrics are now marked as with the ALPHA stability level. (#81531, @logicalhan)
• Move CSI volume expansion to beta. (#81467, @bertinatto)
• Support Kubelet plugin watcher on Windows nodes. (#81397, @ddebroy)
• Updates the requestedToCapacityRatioArguments to add resources parameter that allows the users to specify the resource name along with weights for each resource to score nodes based on the request to capacity ratio. (#77688, @sudeshsh)
• Finalizer Protection for Service LoadBalancers is now in Beta (enabled by default). This feature ensures the Service resource is not fully deleted until the correlating load balancer resources are deleted. (#81691, @MrHohn)
• Adds support for vSphere volumes on Windows (#80911, @gab-satchi)
• Log when kube-apiserver regenerates the OpenAPI spec and why. OpenAPI spec generation is a very CPU-heavy process that is sensitive to continuous updates of CRDs and APIServices. (#81786, @sttts)
  • Added metrics aggregator_openapi_v2_regeneration_count, aggregator_openapi_v2_regeneration_gauge and apiextension_openapi_v2_regeneration_count metrics counting the triggering APIService and CRDs and the reason (add, update, delete).
• Fix an issue with toleration merging & whitelist checking in the PodTolerationRestriction admission controller. (#81732, @tallclair)
• Add a helper function to decode scheduler plugin args. (#80696, @hex108)
• Add metadata.generation=1 to old CustomResources. (#82005, @sttts)
• kubeadm no longer performs IPVS checks as part of its preflight checks (#81791, @yastij)
• The RemainingItemCount feature is now beta. (#81682, @caesarxuchao)
  • remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is estimating the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.
• The CustomResourceDefaulting feature is promoted to beta and enabled by default. Defaults may be specified in structural schemas via the apiextensions.k8s.io/v1 API. See https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/#specifying-a-structural-schema for details. (#81872, @sttts)
• kubectl could scale custom resource again (#81342, @knight42)
• a CSI driver that supports ephemeral inline volumes must explicitly declare that by providing a CSIDriver object where the new "mode" field is set to "ephemeral" or "persistent+ephemeral" (#80568, @pohly)
• framework.ExpectNoError no longer logs the error and instead relies on using the new log.Fail as Gomega fail handler. (#80253, @pohly)
• Audit events now log the existence and patch of mutating webhooks. (#77824, @roycaihw) * At Metadata audit level or higher, an annotation with key "mutation.webhook.admission.k8s.io/round_{round idx}index{order idx}" gets logged with JSON payload indicating a webhook gets invoked for given request and whether it mutated the object or not. * At Request audit level or higher, an annotation with key "patch.webhook.admission.k8s.io/round_{round idx}index{order idx}" get logged with the JSON payload logging the patch sent by a webhook for given request.
• Resolves an issue that prevented block volumes from being resized. (#81429, @huffmanca)
• Verify that CRD default values in OpenAPI specs are pruned, with the exceptions of values under metadata. (#78829, @sttts)
• Use PostFilter instead of Postfilter in the scheduling framework (#81800, @draveness)
  • Use PreFilter instead of Prefilter in the scheduling framework
  • Use PreBind instead of Prebind in the scheduling framework
• Fix kubectl logs -f for windows server containers. (#81747, @Random-Liu)
• fix azure disk naming matching issue due to case sensitive comparison (#81720, @andyzhangx)
• Fixes a bug that when there is a "connection refused" error, the reflector's ListAndWatch func will return directly but what expected is that sleep 1 second and rewatch since the specified resourceVersion. (#81634, @likakuli)
• Fixed a bug with the openAPI definition for io.k8s.apimachinery.pkg.runtime.RawExtension, which previously required a field "raw" to be specified (#80773, @jennybuckley)
• kubeadm: print the stack trace of an error for klog level --v>=5 (#80937, @neolit123)
• Fixes a problem with the iptables proxy mode that could result in long delays (#80368, @danwinship)
  • updating Service/Endpoints IPs in very large clusters on RHEL/CentOS 7.
• kubeadm: support any Linux kernel version newer than 3.10 (#81623, @neolit123)
• Added a metric 'apiserver_watch_events_sizes' that can be used to estimate sizes of watch events in the system. (#80477, @mborsz)
• NormalizeScore plugin set is removed from scheduler framework config API. Use ScorePlugin only. (#80930, @liu-cong)
• kubeadm reset: unmount directories under "/var/lib/kubelet" for linux only (#81494, @Klaven)
• updates fluentd-elasticsearch docker image to fluentd 1.6.3 (#80912, @monotek)
• Kubeadm now seamlessly migrates the CoreDNS Configuration when upgrading CoreDNS. (#78033, @rajansandeep)
• Introduce support for applying pod overhead to pod cgroups, if the PodOverhead feature is enabled. (#79247, @egernst)
• Windows nodes on GCE now run with Windows Defender enabled. (#81625, @pjh)

Documentation

• scheduler.alpha.kubernetes.io/critical-pod annotation is removed. Pod priority (spec.priorityClassName) should be used instead to mark pods as critical. Action required! (#80342, @draveness)
• Removed cadvisor metric labels pod_name and container_name to match instrumentation guidelines. (#80376, @ehashman)
  • Action required: any Prometheus queries that match pod_name and container_name labels (e.g. cadvisor or kubelet probe metrics) must be updated to use pod and container instead.
• Remove DirectCodecFactory(replace with serializer.WithoutConversionCodecFactory), DirectEncoder(replace with runtime.WithVersionEncoder) and DirectDecoder(replace with runtime.WithoutVersionDecoder). action required (#79263, @draveness)

• fix: detach azure disk issue using dangling error (#81266, @andyzhangx)
• Conversion webhooks can now indicate they support receiving and responding with ConversionReview API objects in the apiextensions.k8s.io/v1 version by including v1 in the conversionReviewVersions list in their CustomResourceDefinition. Conversion webhooks must respond with a ConversionReview object in the same apiVersion they receive. apiextensions.k8s.io/v1 ConversionReview responses must specify a response.uid that matches the request.uid of the object they were sent. (#81476, @liggitt)
• The CustomResourceDefinition API type is promoted to apiextensions.k8s.io/v1 with the following changes: (#79604, @liggitt)
  • Use of the new default feature in validation schemas is limited to v1
  • spec.scope is no longer defaulted to Namespaced and must be explicitly specified
  • spec.version is removed; use spec.versions instead
  • spec.validation is removed; use spec.versions[*].schema instead
  • spec.subresources is removed; use spec.versions[*].subresources instead
  • spec.additionalPrinterColumns is removed; use spec.versions[*].additionalPrinterColumns instead
  • spec.conversion.webhookClientConfig is moved to spec.conversion.webhook.clientConfig
  • spec.conversion.conversionReviewVersions is moved to spec.conversion.webhook.conversionReviewVersions
  • spec.versions[*].schema.openAPIV3Schema is now required when creating v1 CustomResourceDefinitions
  • spec.preserveUnknownFields: true is disallowed when creating v1 CustomResourceDefinitions; it must be specified within schema definitions as x-kubernetes-preserve-unknown-fields: true
  • In additionalPrinterColumns items, the JSONPath field was renamed to jsonPath (fixes #66531)
• openapi now advertises correctly supported patch types for custom resources (#81515, @liggitt)
• Kubelet could be run with no Azure identity without subscriptionId configured now. (#81500, @feiskyer)
  • A sample cloud provider configure is: '{"vmType": "vmss", "useInstanceMetadata": true}'.
• Volumes specified in a pod but not used in it are no longer unnecessarily formatted, mounted and reported in node.status.volumesInUse. (#81163, @jsafrane)
• kubeadm: use etcd's /health endpoint for a HTTP liveness probe on localhost instead of having a custom health check using etcdctl (#81385, @neolit123)
• kubeamd: use the --pod-network-cidr flag to init or use the podSubnet field in the kubeadm config to pass a comma separated list of pod CIDRs. (#79033, @Arvinderpal)
• Update to use go 1.12.9 (#81489, @BenTheElder)
• Update Azure SDK + go-autorest API versions (#79574, @justaugustus)
• Extender bind should respect IsInterested (#79804, @yqwang-ms)
• Add instruction to setup "Application Default Credentials" to run GCE Windows e2e tests locally. (#81337, @YangLu1031)
• Scheduler should terminate when it looses leader lock. (#81306, @ravisantoshgudimetla)
• kubelet now exports an "kubelet_evictions" metric that counts the number of pod evictions carried out by the kubelet to reclaim resources (#81377, @sjenning)
• Return error when the scoring plugin returns score out of range [0, 100]. (#81015, @draveness)
• Update to use go 1.12.8 (#81390, @cblecker)
• kube-proxy --cleanup will return the correct exit code if the cleanup was successful (#78775, @johscheuer)
• remove iSCSI volume storage cleartext secrets in logs (#81215, @zouyee)
• Use a named array instead of a score array in normalizing-score phase. (#80901, @draveness)
• If scheduler extender filtered a not found node, current scheduling round for this pod will just be skipped. (#79641, @yqwang-ms)
• Update golang/x/net dependency to bring in fixes for CVE-2019-9512, CVE-2019-9514 (#81394, @cblecker)
• Fixes CVE-2019-11250: client-go header logging (at verbosity levels >= 7) now masks Authorization header contents (#81330, @tedyu)
• Resolves a transient 404 response to custom resource requests during server startup (#81244, @liggitt)
• Non nil DataSource entries on PVC's are now displayed as part of describe pvc output. (#76463, @j-griffith)
• Fix Azure client requests stuck issues on http.StatusTooManyRequests (HTTP Code 429). (#81279, @feiskyer)
• Implement a new feature that allows applying kustomize patches to static pod manifests generated by kubeadm. (#80905, @fabriziopandini)
• Add a service annotation service.beta.kubernetes.io/azure-pip-name to specify the public IP name for Azure load balancer. (#81213, @nilo19)
• Fix a bug in the IPVS proxier where virtual servers are not cleaned up even though the corresponding Service object was deleted. (#80942, @gongguan)
• Add scheduling support for RuntimeClasses. RuntimeClasses can now specify nodeSelector constraints & tolerations, which are merged into the PodSpec for pods using that RuntimeClass. (#80825, @tallclair)
• etcd Docker image can be run as non-root (#79722, @randomvariable)
• kubeadm: the permissions of generated CSR files are changed from 0644 to 0600 (#81217, @SataQiu)
• Fix conflicted cache when the requests are canceled by other Azure operations. (#81282, @feiskyer)
• Fix kubelet NodeLease potential performance issues. Kubelet now will try to update lease using cached one instead of get from API Server every time. (#81174, @answer1991)
• Improves validation errors for custom resources (#81212, @liggitt)
• Improvement in Kube-proxy. Kube-proxy waits for some duration for the node to be defined. (#77167, @paulsubrata55)
• hyperkube will drop support for cloud-controller-manager in a future release (#81219, @dims)
• added an new Prometheus counter metric "sync_proxy_rules_iptables_restore_failures_total" for kube-proxy iptables-restore failures (both ipvs and iptables modes) (#81210, @figo)
• Add a Patch method to ScaleInterface (#80699, @knight42)
• switch to VM Update call in attach/detach disk operation, original CreateOrUpdate call may lead to orphaned VMs or blocked resources (#81208, @andyzhangx)
• Add a azure cloud configuration LoadBalancerName and LoadBalancerResourceGroup to allow the corresponding customizations of azure load balancer. (#81054, @nilo19)
• Update the GCE windows node image to include hot fixes since July. (#81106, @YangLu1031)
• Kubelet considers all static pods as critical. Static pods pass kubelet admission even if a node does not have enough resources. Users must ensure that they account for resources when creating static pods. (#80491, @hpandeycodeit)
• kube-apiserver: the --basic-auth-file flag and authentication mode is deprecated and will be removed in a future release. It is not recommended for production environments. (#81152, @tedyu)
• Fix a bug that pretty printer marshals empty byte or uint8 slice as null (#81096, @roycaihw)
• Deprecate the --cloud-provider-gce-lb-src-cidrs flag in the kube-apiserver. This flag will be removed once the GCE Cloud Provider is removed from kube-apiserver. (#81094, @andrewsykim)
• cloud-controller-manager binaries and docker images are no longer shipped with kubernetes releases. (#81029, @dims)
• API: the metadata.selfLink field is deprecated in individual and list objects. It will no longer be returned starting in v1.20, and the field will be removed entirely in v1.21. (#80978, @wojtek-t)

Documentation

• ACTION REQUIRED: (#80676, @fabriziopandini)
  • kubeadm now deletes the bootstrap-kubelet.conf file after TLS bootstrap
  • User relying on bootstrap-kubelet.conf should switch to kubelet.conf that contains node credentials

• Fixes validation of VolumeAttachment API objects created with inline volume sources. (#80945, @tedyu)
• Azure disks of shared kind will no longer fail if they do not contain skuname or (#80837, @rmweir)

  • storageaccounttype.
    

• kubeadm: fix "certificate-authority" files not being pre-loaded when using file discovery (#80966, @neolit123)
• Errors from pod volume set up are now propagated as pod events. (#80369, @jsafrane)
• kubeadm: enable secure serving for the kube-scheduler (#80951, @neolit123)
• Kubernetes client users may disable automatic compression when invoking Kubernetes APIs by setting the DisableCompression field on their rest.Config. This is recommended when clients communicate primarily over high bandwidth / low latency networks where response compression does not improve end to end latency. (#80919, @smarterclayton)
• kubectl get did not correctly count the number of binaryData keys when listing config maps. (#80827, @smarterclayton)
• Implement "post-filter" extension point for scheduling framework (#78097, @draveness)
• Reduces GCE PD Node Attach Limits by 1 since the node boot disk is considered an attachable disk (#80923, @davidz627)
• This PR fixes an error when using external etcd but storing etcd certificates in the same folder and with the same name used by kubeadm for local etcd certificates; for an older version of kubeadm, the workaround is to avoid file name used by kubeadm for local etcd. (#80867, @fabriziopandini)
• When specifying --(kube|system)-reserved-cgroup, with --cgroup-driver=systemd, it is now possible to use the fully qualified cgroupfs name (i.e. /test-cgroup.slice). (#78793, @mattjmcnaughton)
• kubeadm: treat non-fatal errors as warnings when doing reset (#80862, @drpaneas)
• kube-addon-manager has been updated to v9.0.2 to fix a bug in leader election (#80575) (#80861, @mborsz)
• Determine system model to get credentials for windows nodes. (#80764, @liyanhui1228)
• TBD (#80730, @jennybuckley)
• The AdmissionReview API sent to and received from admission webhooks has been promoted to admission.k8s.io/v1. Webhooks can specify a preference for receiving v1 AdmissionReview objects with admissionReviewVersions: ["v1","v1beta1"], and must respond with an API object in the same apiVersion they are sent. When webhooks use admission.k8s.io/v1, the following additional validation is performed on their responses: (#80231, @liggitt) * response.patch and response.patchType are not permitted from validating admission webhooks * apiVersion: "admission.k8s.io/v1" is required * kind: "AdmissionReview" is required * response.uid: "<value of request.uid>" is required * response.patchType: "JSONPatch" is required (if response.patch is set)
• "kubeadm join" fails if file-based discovery is too long, with a default timeout of 5 minutes. (#80804, @olivierlemasle)
• enhance Azure cloud provider code to support both AAD and ADFS authentication. (#80841, @rjaini)
• Attempt to set the kubelet's hostname & internal IP if --cloud-provider=external and no node addresses exists (#75229, @andrewsykim)
• kubeadm: avoid double deletion of the upgrade prepull DaemonSet (#80798, @xlgao-zju)
• Fixes problems with connecting to services on localhost on some systems; in particular, DNS queries to systemd-resolved on Ubuntu. (#80591, @danwinship)
• Implement normalize plugin extension point for the scheduler framework. (#80383, @liu-cong)
• Fixed the bash completion error with override flags. (#80802, @dtaniwaki)
• Fix CVE-2019-11247: API server allows access to custom resources via wrong scope (#80750, @sttts)
• Failed iscsi logout is now re-tried periodically. (#78941, @jsafrane)
• Fix public IP not found issues for VMSS nodes (#80703, @feiskyer)
• In order to enable dual-stack support within kubeadm and kubernetes components, as part of the init config file, the user should set feature-gate IPv6DualStack=true in the ClusterConfiguration. Additionally, for each worker node, the user should set the feature-gate for kubelet using either nodeRegistration.kubeletExtraArgs or KUBELET_EXTRA_ARGS. (#80531, @Arvinderpal)
• Fix error in kubeadm join --discovery-file when using discovery files with embedded credentials (#80675, @fabriziopandini)