• v1.19.16

  • Downloads for v1.19.16

    • Source Code
    • Client Binaries
    • Server Binaries
    • Node Binaries

  • Changelog since v1.19.15

  • Changes by Kind

    • Bug or Regression

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.15

  • Downloads for v1.19.15

    • Source Code
    • Client Binaries
    • Server Binaries
    • Node Binaries

  • Changelog since v1.19.14

  • Important Security Information

    • CVE-2021-25741: Symlink Exchange Can Allow Host Filesystem Access

  • Changes by Kind

    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.14

  • Downloads for v1.19.14

    • Source Code
    • Client Binaries
    • Server Binaries
    • Node Binaries

  • Changelog since v1.19.13

  • Changes by Kind

    • Feature

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.13

  • Downloads for v1.19.13

    • Source Code
    • Client Binaries
    • Server Binaries
    • Node Binaries

  • Changelog since v1.19.12

  • Changes by Kind

    • Feature
    • Bug or Regression

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.12

  • Downloads for v1.19.12

    • Source Code
    • Client Binaries
    • Server Binaries
    • Node Binaries

  • Changelog since v1.19.11

  • Changes by Kind

    • Feature
    • Failing Test
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.11

  • Downloads for v1.19.11

    • Source Code
    • Client Binaries
    • Server Binaries
    • Node Binaries

  • Changelog since v1.19.10

  • Changes by Kind

    • API Change
    • Feature
    • Bug or Regression

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.10

  • Downloads for v1.19.10

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.9

  • Important Security Information

    • CVE-2021-25735: Validating Admission Webhook does not observe some previous fields

  • Changes by Kind

    • API Change
    • Feature
    • Bug or Regression

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.9

  • Downloads for v1.19.9

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.8

  • Changes by Kind

    • Failing Test
    • Bug or Regression

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.8

  • Downloads for v1.19.8

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.7

  • Changes by Kind

    • API Change
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.7

  • Downloads for v1.19.7

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.6

  • Changes by Kind

    • Bug or Regression

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.6

  • Downloads for v1.19.6

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.5

  • Changes by Kind

    • Feature
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.5

  • Downloads for v1.19.5

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.4

  • Changes by Kind

    • Feature
    • Failing Test
    • Bug or Regression

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.4

  • Downloads for v1.19.4

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.3

  • Changes by Kind

    • Bug or Regression

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.3

  • Downloads for v1.19.3

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.2

  • Changes by Kind

    • Feature
    • Design
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.2

  • Downloads for v1.19.2

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.1

  • Changes by Kind

    • API Change
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.1

  • Downloads for v1.19.1

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.0

  • Changes by Kind

    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.0

  • Downloads for v1.19.0

    • Source Code
    • Client Binaries
    • Server Binaries
    • Node Binaries

  • Changelog since v1.18.0

  • What’s New (Major Themes)

    • Deprecation warnings
    • Avoiding permanent beta
    • Expanded CLI support for debugging workloads and nodes
    • Structured logging
    • EndpointSlices are now enabled by default
    • Ingress graduates to General Availability
    • seccomp graduates to General Availability
    • Production images moved to community control
    • KubeSchedulerConfiguration graduates to Beta
    • CSI Migration - AzureDisk and vSphere (beta)
    • Storage capacity tracking
    • CSI Volume health monitoring
    • General ephemeral volumes
    • Immutable Secrets and ConfigMaps (beta)
    • CSI Proxy for Windows
    • Dashboard v2
    • Windows containerd support graduates to beta
    • Increase the Kubernetes support window to one year

  • Known Issues

  • Urgent Upgrade Notes

    • (No, really, you MUST read this before you upgrade)

  • Changes by Kind

    • Deprecation
    • API Change
    • Feature
    • Documentation
    • Failing Test
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.0-rc.4

  • Downloads for v1.19.0-rc.4

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.0-rc.3

  • Changes by Kind

    • Deprecation
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.0-rc.3

  • Downloads for v1.19.0-rc.3

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.0-rc.2

  • Changes by Kind

    • API Change
    • Bug or Regression

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.0-rc.2

  • Downloads for v1.19.0-rc.2

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.0-rc.1

  • Changes by Kind

    • API Change
    • Feature
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.0-rc.1

  • Downloads for v1.19.0-rc.1

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.0-rc.0

  • Urgent Upgrade Notes

    • (No, really, you MUST read this before you upgrade)

  • Changes by Kind

    • Deprecation
    • API Change
    • Feature
    • Failing Test
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.0-beta.2

  • Downloads for v1.19.0-beta.2

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.0-beta.1

  • Changes by Kind

    • Deprecation
    • API Change
    • Feature
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.0-beta.1

  • Downloads for v1.19.0-beta.1

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.0-alpha.3

  • Urgent Upgrade Notes

    • (No, really, you MUST read this before you upgrade)

  • Changes by Kind

    • API Change
    • Feature
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.0-beta.0

  • Downloads for v1.19.0-beta.0

    • Source Code
    • Client binaries
    • Server binaries
    • Node binaries

  • Changelog since v1.19.0-alpha.3

  • Changes by Kind

    • API Change
    • Feature
    • Bug or Regression
    • Other (Cleanup or Flake)

  • Dependencies

    • Added
    • Changed
    • Removed

• v1.19.0-alpha.3

  • Downloads for v1.19.0-alpha.3

    • Source Code
    • Client Binaries
    • Server Binaries
    • Node Binaries

  • Changelog since v1.19.0-alpha.2

  • Urgent Upgrade Notes

    • (No, really, you MUST read this before you upgrade)

  • Changes by Kind

    • Deprecation
    • API Change
    • Feature
    • Bug or Regression
    • Other (Cleanup or Flake)

• v1.19.0-alpha.2

  • Downloads for v1.19.0-alpha.2

    • Source Code
    • Client Binaries
    • Server Binaries
    • Node Binaries

  • Changelog since v1.19.0-alpha.1

  • Urgent Upgrade Notes

    • (No, really, you MUST read this before you upgrade)

  • Changes by Kind

    • API Change
    • Feature
    • Bug or Regression
    • Other (Cleanup or Flake)

• v1.19.0-alpha.1

  • Downloads for v1.19.0-alpha.1

    • Source Code
    • Client Binaries
    • Server Binaries
    • Node Binaries

  • Changelog since v1.19.0-alpha.0

  • Urgent Upgrade Notes

    • (No, really, you MUST read this before you upgrade)

  • Changes by Kind

    • Deprecation
    • API Change
    • Feature
    • Documentation
    • Other (Bug, Cleanup or Flake)

1. v1.19.16

1.1. Downloads for v1.19.16

1.1.1. Source Code

1.1.2. Client Binaries

1.1.3. Server Binaries

1.1.4. Node Binaries

1.2. Changelog since v1.19.15

1.3. Changes by Kind

1.3.1. Bug or Regression

• Fix detach from non-existant nodes and support dangling volumes (#104912, @gnufied) [SIG Cloud Provider and Storage]
• Revert PR #102925 which introduced unexpected scheduling behavior based on balanced resource allocation (#105526, @harisund) [SIG Scheduling]

1.4. Dependencies

1.4.1. Added

Nothing has changed.

1.4.2. Changed

Nothing has changed.

1.4.3. Removed

Nothing has changed.

2. v1.19.15

2.1. Downloads for v1.19.15

2.1.1. Source Code

2.1.2. Client Binaries

2.1.3. Server Binaries

2.1.4. Node Binaries

2.2. Changelog since v1.19.14

2.3. Important Security Information

This release contains changes that address the following vulnerabilities:

2.3.1. CVE-2021-25741: Symlink Exchange Can Allow Host Filesystem Access

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

Affected Versions:

• kubelet v1.22.0 - v1.22.1
• kubelet v1.21.0 - v1.21.4
• kubelet v1.20.0 - v1.20.10
• kubelet <= v1.19.14

Fixed Versions:

• kubelet v1.22.2
• kubelet v1.21.5
• kubelet v1.20.11
• kubelet v1.19.15

This vulnerability was reported by Fabricio Voznika and Mark Wolters of Google.

CVSS Rating: High (8.8) CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

2.4. Changes by Kind

2.4.1. Bug or Regression

• Fix race condition in scheduler where a new unschedulable Pod might never be retried. (#105015, @alculquicondor) [SIG Apps, Scheduling and Testing]
• Fix: skip case sensitivity when checking Azure NSG rules fix: ensure InstanceShutdownByProviderID return false for creating Azure VMs (#104449, @feiskyer) [SIG Cloud Provider]
• Fixed a bug in the job controller to not mutate the shared cache (#104130, @adtac) [SIG Apps]
• For statically provisioned PVs ensure that we use canonical path whenever possible for attach/detach (#104485, @gnufied) [SIG Cloud Provider and Storage]
• Metrics changes: Fix exposed buckets of scheduler_volume_scheduling_duration_seconds_bucket metric (#100720, @dntosas) [SIG Apps, Instrumentation, Scheduling and Storage]
• Pass additional flags to subpath mount to avoid flakes in certain conditions (#104340, @mauriciopoppe) [SIG Node, Storage and Windows]

2.4.2. Other (Cleanup or Flake)

• Kube-apiserver: sets an upper-bound on the lifetime of idle keep-alive connections and time to read the headers of incoming requests (#103958, @liggitt) [SIG API Machinery and Node]

2.5. Dependencies

2.5.1. Added

Nothing has changed.

2.5.2. Changed

Nothing has changed.

2.5.3. Removed

Nothing has changed.

3. v1.19.14

3.1. Downloads for v1.19.14

3.1.1. Source Code

3.1.2. Client Binaries

3.1.3. Server Binaries

3.1.4. Node Binaries

3.2. Changelog since v1.19.13

3.3. Changes by Kind

3.3.1. Feature

• Kubernetes 1.19.x is now built using Go 1.15.15 (#104216, @cpanato) [SIG Cloud Provider, Instrumentation, Release and Testing]

3.4. Dependencies

3.4.1. Added

Nothing has changed.

3.4.2. Changed

Nothing has changed.

3.4.3. Removed

Nothing has changed.

4. v1.19.13

4.1. Downloads for v1.19.13

4.1.1. Source Code

4.1.2. Client Binaries

4.1.3. Server Binaries

4.1.4. Node Binaries

4.2. Changelog since v1.19.12

4.3. Changes by Kind

4.3.1. Feature

• Kubernetes 1.19.x is now built using Go 1.15.14 (#103705, @puerco) [SIG Cloud Provider, Instrumentation, Release and Testing]
• Updates the following images to pick up CVE fixes:
  • debian to v1.8.0
  • debian-iptables to v1.6.5
  • setcap to v2.0.3 (#103235, @thejoycekung) [SIG API Machinery, Release and Testing]

4.3.2. Bug or Regression

• Fix scoring for NodeResourcesMostAllocated and NodeResourcesBalancedAllocation plugins when nodes have containers with no requests. This was leaving to under-utilization of small nodes. (#102925, @alculquicondor) [SIG Scheduling]
• Fixes a cannot convert int64 to float64 error seen using server-side apply with certain CRDs in 1.19.10+ (#103105, @liggitt) [SIG API Machinery]
• Switch scheduler to generate the merge patch on pod status instead of the full pod (#103133, @marwanad) [SIG Scheduling]

4.4. Dependencies

4.4.1. Added

Nothing has changed.

4.4.2. Changed

• sigs.k8s.io/structured-merge-diff/v4: v4.0.3 → v4.1.2

4.4.3. Removed

Nothing has changed.

5. v1.19.12

5.1. Downloads for v1.19.12

5.1.1. Source Code

5.1.2. Client Binaries

5.1.3. Server Binaries

5.1.4. Node Binaries

5.2. Changelog since v1.19.11

5.3. Changes by Kind

5.3.1. Feature

• Kubernetes is now built using Go 1.15.13 (#102809, @thejoycekung) [SIG Cloud Provider, Instrumentation, Release and Testing]

5.3.2. Failing Test

• Fixes the should receive events on concurrent watches in same order conformance test to work properly on clusters that auto-create additional configmaps in namespaces (#101950, @liggitt) [SIG API Machinery and Testing]

5.3.3. Bug or Regression

• Avoid caching the Azure VMSS instances whose network profile is nil (#100948, @feiskyer) [SIG Cloud Provider]
• Azure: avoid setting cached Sku when updating VMSS and VMSS instances (#102005, @feiskyer) [SIG Cloud Provider]
• Fix a bug that a preemptor pod may exist as a phantom in the scheduler. (#102498, @Huang-Wei) [SIG Scheduling]
• Fix errors when accessing Windows container stats for Dockershim (#98510, @jsturtevant) [SIG Node and Windows]
• Fix: delete non existing disk issue (#102083, @andyzhangx) [SIG Cloud Provider]
• Fixed false-positive uncertain volume attachments, which led to unexpected detachment of CSI migrated volumes (#101737, @Jiawei0227) [SIG Apps and Storage]
• Fixed garbage collection of dangling VolumeAttachments for PersistentVolumes migrated to CSI on startup of kube-controller-manager. (#102176, @timebertt) [SIG Apps and Storage]
• Fixes an issue where default RBAC policy could fail to reconcile on API server startup if an error was encountered (#101954, @voutcn) [SIG Auth]
• Improve speed of vSphere PV provisioning and reduce number of API calls (#102351, @gnufied) [SIG Cloud Provider and Storage]
• Register/Deregister Targets in chunks for AWS TargetGroup (#101592, @M00nF1sh) [SIG Cloud Provider]
• Respect annotation size limit for server-side apply updates to the client-side apply annotation. Also, fix opt-out of this behavior by setting the client-side apply annotation to the empty string. (#102105, @julianvmodesto) [SIG API Machinery]
• Reverted the previous fix for portforward cleanup because it introduced a kubelet regression which can lead into segmentation faults. (#102588, @saschagrunert) [SIG API Machinery and Node]

5.3.4. Other (Cleanup or Flake)

• Update the Debian images to pick up CVE fixes in the base images:
  • Update the debian-base image to v1.7.0
  • Update the debian-iptables image to v1.6.1 (#102342, @cpanato) [SIG API Machinery and Testing]

5.4. Dependencies

5.4.1. Added

Nothing has changed.

5.4.2. Changed

Nothing has changed.

5.4.3. Removed

Nothing has changed.

6. v1.19.11

6.1. Downloads for v1.19.11

6.1.1. Source Code

6.1.2. Client Binaries

6.1.3. Server Binaries

6.1.4. Node Binaries

6.2. Changelog since v1.19.10

6.3. Changes by Kind

6.3.1. API Change

• We have added a new Priority & Fairness rule that exempts all probes (/readyz, /healthz, /livez) to prevent restarting of "healthy" kube-apiserver instance(s) by kubelet. (#101113, @tkashem) [SIG API Machinery]

6.3.2. Feature

• Kubernetes is now built using go1.15.11 (#101197, @cpanato) [SIG Cloud Provider, Instrumentation, Release and Testing]
• Kubernetes is now built using go1.15.12 (#101846, @cpanato) [SIG Cloud Provider, Instrumentation, Release and Testing]

6.3.3. Bug or Regression

• Azurefile: Normalize share name to not include capital letters (#100731, @kassarl) [SIG Cloud Provider and Storage]
• EndpointSlice IP validation now matches Endpoints IP validation. (#101084, @robscott) [SIG Apps and Network]
• EndpointSlice controllers are less likely to create duplicate EndpointSlices. (#101764, @aojea) [SIG Apps and Network]
• Ensure service deleted when the Azure resource group has been deleted (#100944, @feiskyer) [SIG Cloud Provider]
• Fix panic in JSON logging format caused by missing Duration encoder (#101159, @serathius) [SIG API Machinery, Cluster Lifecycle and Instrumentation]
• Fix: azure file inline volume namespace issue in csi migration translation (#101235, @andyzhangx) [SIG Apps, Cloud Provider, Node and Storage]
• Fixed a bug where startupProbe stopped working after a container's first restart (#101093, @wzshiming) [SIG Node]
• Fixed port-forward memory leak for long-running and heavily used connections. (#99839, @saschagrunert) [SIG API Machinery and Node]
• Kubelet: improve the performance when waiting for a synchronization of the node list with the kube-apiserver (#99336, @neolit123) [SIG Node]
• No support endpointslice in linux userpace mode (#101502, @JornShen) [SIG Network]

6.4. Dependencies

6.4.1. Added

Nothing has changed.

6.4.2. Changed

Nothing has changed.

6.4.3. Removed

Nothing has changed.

7. v1.19.10

7.1. Downloads for v1.19.10

7.1.1. Source Code

7.1.2. Client binaries

7.1.3. Server binaries

7.1.4. Node binaries

7.2. Changelog since v1.19.9

7.3. Important Security Information

This release contains changes that address the following vulnerabilities:

7.3.1. CVE-2021-25735: Validating Admission Webhook does not observe some previous fields

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. You are only affected by this vulnerability if you run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object.

Note: This only impacts validating admission plugins that rely on old values in certain fields, and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin.

Affected Versions:

• kube-apiserver v1.20.0 - v1.20.5
• kube-apiserver v1.19.0 - v1.19.9
• kube-apiserver <= v1.18.17

Fixed Versions:

• kube-apiserver v1.21.0
• kube-apiserver v1.20.6
• kube-apiserver v1.19.10
• kube-apiserver v1.18.18

This vulnerability was reported by Rogerio Bastos & Ari Lima from RedHat

CVSS Rating: Medium (6.5) CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

7.4. Changes by Kind

7.4.1. API Change

• Fixes using server-side apply with APIService resources (#100713, @kevindelgado) [SIG API Machinery, Apps, Scheduling and Testing]
• Regenerate protobuf code to fix CVE-2021-3121 (#100515, @joelsmith) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Node and Storage]

7.4.2. Feature

• AWS cloudprovider supports auto-discovering subnets without any kubernetes.io/cluster/ tags. It also supports additional service annotation service.beta.kubernetes.io/aws-load-balancer-subnets to manually configure the subnets. (#97431, @kishorj) [SIG Cloud Provider]
• AWS cloudprovider will ignore provisioning load balancers if the annotation service.beta.kubernetes.io/aws-load-balancer-type is external or nlb-ip (#97975, @kishorj) [SIG Cloud Provider]
• Kubernetes is now built using go1.15.10 (#100520, @cpanato) [SIG Cloud Provider, Instrumentation, Release and Testing]

7.4.3. Bug or Regression

• Fixed a bug where a high churn of events was causing master instability by reducing the maximum number of objects (events) attached to a single etcd lease. (#100450, @mborsz) [SIG API Machinery and Instrumentation]
• Fixed a race condition on API server startup ensuring previously created webhook configurations are effective before the first write request is admitted. (#95783, @roycaihw) [SIG API Machinery]
• Fixes a data race issue in the priority and fairness API server filter (#100669, @tkashem) [SIG API Machinery]
• Kubectl: Fixed panic when describing an ingress backend without an API Group (#100542, @eddiezane) [SIG CLI]
• Reverts breaking change to inline AzureFile volumes in v1.19.7-v1.19.9; referenced secrets are now correctly searched for in the same namespace as the pod as in previous releases. (#100398, @andyzhangx) [SIG Cloud Provider and Storage]
• The endpointslice mirroring controller mirrors endpoints annotations and labels to the generated endpoint slices, it also ensures that updates on any of these fields on the endpoints are mirrored. The well-known annotation endpoints.kubernetes.io/last-change-trigger-time is skipped and not mirrored. (#100443, @aojea) [SIG Apps, Network and Testing]
• The maximum number of ports allowed in EndpointSlices has been increased from 100 to 20,000 (#99795, @robscott) [SIG Network]

7.5. Dependencies

7.5.1. Added

Nothing has changed.

7.5.2. Changed

• github.com/gogo/protobuf: v1.3.1 → v1.3.2
• github.com/kisielk/errcheck: v1.2.0 → v1.5.0
• github.com/yuin/goldmark: v1.1.27 → v1.2.1
• golang.org/x/sync: cd5d95a → 67f06af
• golang.org/x/tools: c1934b7 → 113979e
• golang.org/x/xerrors: 9bdfabe → 5ec99f8
• sigs.k8s.io/structured-merge-diff/v4: v4.0.1 → v4.0.3

7.5.3. Removed

Nothing has changed.

8. v1.19.9

8.1. Downloads for v1.19.9

8.1.1. Source Code

8.1.2. Client binaries

8.1.3. Server binaries

8.1.4. Node binaries

8.2. Changelog since v1.19.8

8.3. Changes by Kind

8.3.1. Failing Test

• Fix handing special characters in the volume path on Windows (#99137, @yujuhong) [SIG Storage]

8.3.2. Bug or Regression

• Count pod overhead against an entity's ResourceQuota (#99600, @gjkim42) [SIG API Machinery and Node]
• EndpointSlice controller is now less likely to emit FailedToUpdateEndpointSlices events. (#100114, @robscott) [SIG Apps and Network]
• EndpointSliceMirroring controller is now less likely to emit FailedToUpdateEndpointSlices events. (#100144, @robscott) [SIG Apps and Network]
• Fixed bug that caused cAdvisor to incorrectly detect single-socket multi-NUMA topology. (#99209, @iwankgb) [SIG Node]
• Fixes kubelet to retrieve number of sockets from cAdvisor MachineInfo, instead of assuming it to be equal to number of NUMA nodes. (#99771, @iwankgb) [SIG Node]
• Fixing a bug where a failed node may not have the NoExecute taint set correctly (#98140, @CKchen0726) [SIG Apps and Node]
• Kubelet now cleans up orphaned volume directories automatically (#95301, @lorenz) [SIG Node and Storage]
• Resolves spurious Failed to list *v1.Secret or Failed to list *v1.ConfigMap messages in kubelet logs. (#99538, @liggitt) [SIG Auth and Node]
• Using NUMA nodes instead of sockets for CPU manager hints. (#99276, @iwankgb) [SIG Node]
• We will no longer automatically delete all data when a failure is detected during creation of the volume data file on a CSI volume. Now we will only remove the data file and volume path. (#96021, @huffmanca) [SIG Storage]

8.4. Dependencies

8.4.1. Added

Nothing has changed.

8.4.2. Changed

• github.com/google/cadvisor: v0.37.4 → v0.37.5
• sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.0.9 → v0.0.15

8.4.3. Removed

Nothing has changed.

9. v1.19.8

9.1. Downloads for v1.19.8

9.1.1. Source Code

9.1.2. Client binaries

9.1.3. Server binaries

9.1.4. Node binaries

9.2. Changelog since v1.19.7

9.3. Changes by Kind

9.3.1. API Change

• Kubernetes is now built using go1.15.8 (#99093, @cpanato) [SIG Cloud Provider, Instrumentation, Release and Testing]

9.3.2. Bug or Regression

• Aggregate errors when putting vmss (#98350, @nilo19) [SIG Cloud Provider]
• Avoid marking node as Ready until node has synced with API servers at least once (#97996, @ehashman) [SIG Node]
• Cleanup subnet in frontend IP configs to prevent huge subnet request bodies in some scenarios. (#98288, @nilo19) [SIG Cloud Provider]
• Fix CSI-migrated inline EBS volumes failing to mount if their volumeID is prefixed by aws:// (#96821, @wongma7) [SIG Storage]
• Fix azure file migration issue (#97877, @andyzhangx) [SIG Auth, Cloud Provider and Storage]
• Fix the description of command line flags that can override --config (#98873, @changshuchao) [SIG Scheduling]
• Fix to recover CSI volumes from certain dangling attachments (#96617, @yuga711) [SIG Apps and Storage]
• Fixed a bug that the kubelet cannot start on BtrfS. (#98015, @gjkim42) [SIG Node]
• Fixed a bug where aggregator_unavailable_apiservice metrics were reported for deleted apiservices. (#96421, @dgrisonnet) [SIG API Machinery and Instrumentation]
• Fixed provisioning of Cinder volumes migrated to CSI when StorageClass with AllowedTopologies was used. (#98311, @jsafrane) [SIG Storage]
• Fixes a panic in the disruption budget controller for PDB objects with invalid selectors (#98776, @ialidzhikov) [SIG Apps]
• Kubeadm: get k8s CI version markers from k8s infra bucket (#98836, @hasheddan) [SIG Cluster Lifecycle and Release]
• Kubelet should ignore cgroup driver check on Windows node. (#98385, @pacoxu) [SIG Node]
• Performance regression #97685 has been fixed (#98432, @tkashem) [SIG API Machinery]
• Static pods will be deleted gracefully. (#98103, @gjkim42) [SIG Node]
• Truncates a message if it hits the NoteLengthLimit when the scheduler records an event for the pod that indicates the pod has failed to schedule. (#98715, @carlory) [SIG Scheduling]
• Warning about using a deprecated volume plugin is logged only once. (#96751, @jsafrane) [SIG Storage]

9.3.3. Other (Cleanup or Flake)

• Kubeadm: change the default image repository for CI images from 'gcr.io/kubernetes-ci-images' to 'gcr.io/k8s-staging-ci-images' (#97087, @SataQiu) [SIG Cluster Lifecycle]
• Resolves flakes in the Ingress conformance tests due to conflicts with controllers updating the Ingress object (#98430, @liggitt) [SIG Network and Testing]

9.4. Dependencies

9.4.1. Added

Nothing has changed.

9.4.2. Changed

• github.com/google/cadvisor: v0.37.3 → v0.37.4

9.4.3. Removed

Nothing has changed.

10. v1.19.7

10.1. Downloads for v1.19.7

10.1.1. Source Code

10.1.2. Client binaries

10.1.3. Server binaries

10.1.4. Node binaries

10.2. Changelog since v1.19.6

10.3. Changes by Kind

10.3.1. Bug or Regression

• Fix Azure file share not deleted issue when the namespace is deleted (#97417, @andyzhangx) [SIG Cloud Provider and Storage]
• Fix counting error in service/nodeport/loadbalancer quota check (#97828, @pacoxu) [SIG API Machinery and Network]
• Fix missing cadvisor machine metrics. (#97006, @lingsamuel) [SIG Node]
• Fix: azure file latency issue for metadata-heavy workloads (#97082, @andyzhangx) [SIG Cloud Provider and Storage]
• Fixed bug in CPUManager with race on container map access (#97427, @klueska) [SIG Node]
• GCE Internal LoadBalancer sync loop will now release the ILB IP address upon sync failure. An error in ILB forwarding rule creation will no longer leak IP addresses. (#97740, @prameshj) [SIG Cloud Provider and Network]
• Kubeadm: avoid detection of the container runtime for commands that do not need it (#97848, @pacoxu) [SIG Cluster Lifecycle]

10.4. Dependencies

10.4.1. Added

Nothing has changed.

10.4.2. Changed

Nothing has changed.

10.4.3. Removed

Nothing has changed.

11. v1.19.6

11.1. Downloads for v1.19.6

11.1.1. Source Code

11.1.2. Client binaries

11.1.3. Server binaries

11.1.4. Node binaries

11.2. Changelog since v1.19.5

11.3. Changes by Kind

11.3.1. Feature

• Kubernetes is now built using go1.15.5
  • build: Update to k/repo-infra@v0.1.3 (supports go1.15.5) (#97246, @justaugustus) [SIG Cloud Provider, Release and Testing]

11.3.2. Bug or Regression

• AcceleratorStats will be available in the Summary API of kubelet when cri_stats_provider is used. (#97017, @ruiwen-zhao) [SIG Node]
• Exposes and sets a default timeout for the SubjectAccessReview client for DelegatingAuthorizationOptions (#95910, @p0lyn0mial) [SIG API Machinery and Cloud Provider]
• Fix the panic when kubelet registers if a node object already exists with no Status.Capacity or Status.Allocatable (#96297, @SataQiu) [SIG Node]
• Fixed FibreChannel volume plugin corrupting filesystems on detach of multipath volumes. (#97013, @jsafrane) [SIG Storage]
• Fixed a bug in kubelet that will saturate CPU utilization after containerd got restarted. (#97176, @hanlins) [SIG Node]
• Remove ready file and its directory (which is created during volume SetUp) during emptyDir volume TearDown. (#95770, @jingxu97) [SIG Storage]
• Volumebinding: report UnschedulableAndUnresolvable status instead of an error when PVC not found (#96850, @cofyc) [SIG Scheduling and Storage]

11.3.3. Other (Cleanup or Flake)

• Client-go header logging (at verbosity levels >= 9) now masks Authorization header contents (#95316, @sfowl) [SIG API Machinery]

11.4. Dependencies

11.4.1. Added

Nothing has changed.

11.4.2. Changed

• github.com/google/cadvisor: v0.37.2 → v0.37.3

11.4.3. Removed

Nothing has changed.

12. v1.19.5

12.1. Downloads for v1.19.5

12.1.1. Source Code

12.1.2. Client binaries

12.1.3. Server binaries

12.1.4. Node binaries

12.2. Changelog since v1.19.4

12.3. Changes by Kind

12.3.1. Feature

• Add a new flag to set priority for the kubelet on Windows nodes so that workloads cannot overwhelm the node there by disrupting kubelet process. (#96157, @ravisantoshgudimetla) [SIG Node and Windows]

12.3.2. Failing Test

• Resolves an issue running Ingress conformance tests on clusters which use finalizers on Ingress objects to manage releasing load balancer resources (#96742, @spencerhance) [SIG Network and Testing]

12.3.3. Bug or Regression

• Bump node-problem-detector version to v0.8.5 to fix OOM detection in with Linux kernels 5.1+ (#96716, @tosi3k) [SIG Cloud Provider, Scalability and Testing]
• Exposes and sets a default timeout for the SubjectAccessReview client for DelegatingAuthorizationOptions (#95910, @p0lyn0mial) [SIG API Machinery and Cloud Provider]
• Fix a bug that DefaultPreemption plugin is disabled when using (legacy) scheduler policy. (#96472, @Huang-Wei) [SIG Scheduling and Testing]
• Fix bug in JSON path parser where an error occurs when a range is empty (#95933, @brianpursley) [SIG API Machinery]
• Fix memory leak in kube-apiserver when underlying time goes forth and back. (#96266, @chenyw1990) [SIG API Machinery]
• Fix pull image error from multiple ACRs using azure managed identity (#96355, @andyzhangx) [SIG Cloud Provider]
• Fix: resize Azure disk issue when it's in attached state (#96705, @andyzhangx) [SIG Cloud Provider]
• Fixed a bug that prevents kubectl to validate CRDs with schema using x-kubernetes-preserve-unknown-fields on object fields. Fix kubectl SchemaError on CRDs with schema using x-kubernetes-preserve-unknown-fields on array types. (#96562, @gautierdelorme) [SIG API Machinery and Testing]
• Fixes an issue with the max-in-flight API server filter where the filter could take a long time to process an incoming request if it had been a long time since the last request. (#96282, @staebler) [SIG API Machinery]
• HTTP/2 connection health check is enabled by default in all Kubernetes clients. The feature should work out-of-the-box. If needed, users can tune the feature via the HTTP2_READ_IDLE_TIMEOUT_SECONDS and HTTP2_PING_TIMEOUT_SECONDS environment variables. The feature is disabled if HTTP2_READ_IDLE_TIMEOUT_SECONDS is set to 0. (#96778, @caesarxuchao) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Node]
• Kubeadm: Fixes a kubeadm upgrade bug that could cause a custom CoreDNS configuration to be replaced with the default. (#97016, @rajansandeep) [SIG Cluster Lifecycle]
• Kubeadm: fix coredns migration should be triggered when there are newdefault configs during kubeadm upgrade (#96970, @pacoxu) [SIG Cluster Lifecycle]
• Metric names for CSI and flexvolume drivers will include the driver name as well as the CSI plugin name. (#96477, @mattcary) [SIG Instrumentation and Storage]
• New Azure instance types do now have correct max data disk count information. (#94340, @ialidzhikov) [SIG Cloud Provider and Storage]
• Resolves a regression in 1.19+ with workloads targeting deprecated beta os/arch labels getting stuck in NodeAffinity status on node startup. (#96810, @liggitt) [SIG Node]
• Volume binding: report UnschedulableAndUnresolvable status instead of an error when bound PVs not found (#96291, @cofyc) [SIG Apps, Scheduling and Storage]

12.4. Dependencies

12.4.1. Added

Nothing has changed.

12.4.2. Changed

• github.com/google/cadvisor: v0.37.0 → v0.37.2
• golang.org/x/net: ab34263 → 69a7880
• golang.org/x/sys: ed371f2 → 5cba982

12.4.3. Removed

Nothing has changed.

13. v1.19.4

13.1. Downloads for v1.19.4

13.1.1. Source Code

13.1.2. Client binaries

13.1.3. Server binaries

13.1.4. Node binaries

13.2. Changelog since v1.19.3

13.3. Changes by Kind

13.3.1. Bug or Regression

• An issues preventing volume expand controller to annotate the PVC with volume.kubernetes.io/storage-resizer when the PVC StorageClass is already updated to the out-of-tree provisioner is now fixed. (#94489, @ialidzhikov) [SIG API Machinery, Apps and Storage]
• Cloud node controller: handle empty providerID from getProviderID (#95452, @nicolehanjing) [SIG Cloud Provider]
• Disable watchcache for events (#96052, @wojtek-t) [SIG API Machinery]
• Disabled LocalStorageCapacityIsolation feature gate is honored during scheduling. (#96140, @Huang-Wei) [SIG Scheduling]
• Fix a bug that Pods with topologySpreadConstraints get scheduled to nodes without required labels. (#95880, @ialidzhikov) [SIG Scheduling]
• Fix azure disk attach failure for disk size bigger than 4TB (#95463, @andyzhangx) [SIG Cloud Provider]
• Fix azure disk data loss issue on Windows when unmount disk (#95456, @andyzhangx) [SIG Cloud Provider and Storage]
• Fixed a bug causing incorrect formatting of kubectl describe ingress. (#94985, @howardjohn) [SIG CLI and Network]
• Fixed a bug in client-go where new clients with customized Dial, Proxy, GetCert config may get stale HTTP transports. (#95427, @roycaihw) [SIG API Machinery]
• Fixed a regression which prevented pods with docker/default seccomp annotations from being created in 1.19 if a PodSecurityPolicy was in place which did not allow runtime/default seccomp profiles. (#95990, @saschagrunert) [SIG Auth]
• Fixed kubelet creating extra sandbox for pods with RestartPolicyOnFailure after all containers succeeded (#92614, @tnqn) [SIG Node and Testing]
• Fixes high CPU usage in kubectl drain (#95260, @amandahla) [SIG CLI]
• If we set SelectPolicy MinPolicySelect on scaleUp behavior or scaleDown behavior,Horizontal Pod Autoscaler doesn't automatically scale the number of pods correctly (#95647, @JoshuaAndrew) [SIG Apps and Autoscaling]
• Kube-proxy now trims extra spaces found in loadBalancerSourceRanges to match Service validation. (#94107, @robscott) [SIG Network]
• Kubeadm: add missing "--experimental-patches" flag to "kubeadm init phase control-plane" (#95786, @Sh4d1) [SIG Cluster Lifecycle]

13.4. Dependencies

13.4.1. Added

Nothing has changed.

13.4.2. Changed

Nothing has changed.

13.4.3. Removed

Nothing has changed.

14. v1.19.3

14.1. Downloads for v1.19.3

14.1.1. Source Code

14.1.2. Client binaries

14.1.3. Server binaries

14.1.4. Node binaries

14.2. Changelog since v1.19.2

14.3. Changes by Kind

14.3.1. Feature

• Kubernetes is now built using go1.15.2

  • build: Update to k/repo-infra@v0.1.1 (supports go1.15.2)
  • build: Use go-runner:buster-v2.0.1 (built using go1.15.1)
  • bazel: Replace --features with Starlark build settings flag

  • hack/lib/util.sh: some bash cleanups

    • switched one spot to use kube::logging
    • make kube::util::find-binary return an error when it doesn't find anything so that hack scripts fail fast instead of with '' binary not found errors.
    • this required deleting some genfeddoc stuff. the binary no longer exists in k/k repo since we removed federation/, and I don't see it in https://github.com/kubernetes-sigs/kubefed/ either. I'm assuming that it's gone for good now.

  • bazel: output go_binary rule directly from go_binary_conditional_pure

    From: @mikedanese: Instead of aliasing. Aliases are annoying in a number of ways. This is specifically bugging me now because they make the action graph harder to analyze programmatically. By using aliases here, we would need to handle potentially aliased go_binary targets and dereference to the effective target.

    The comment references an issue with pure = select(...) which appears to be resolved considering this now builds.

  • make kube::util::find-binary not dependent on bazel-out/ structure

    Implement an aspect that outputs go_build_mode metadata for go binaries, and use that during binary selection. (#94838, @justaugustus) [SIG Architecture, Release and Testing]

14.3.2. Design

• Prevent logging of docker config contents if file is malformed (#95346, @sfowl) [SIG Auth and Node]

14.3.3. Bug or Regression

• Do not fail sorting empty elements. (#94666, @soltysh) [SIG CLI]
• Ensure getPrimaryInterfaceID not panic when network interfaces for Azure VMSS are null (#94802, @nilo19) [SIG Cloud Provider]
• Fix azure file migration panic (#94853, @andyzhangx) [SIG Cloud Provider]
• Fix bug where loadbalancer deletion gets stuck because of missing resource group #75198 (#93962, @phiphi282) [SIG Cloud Provider]
• Fix detach azure disk issue when vm not exist (#95177, @andyzhangx) [SIG Cloud Provider]
• Fix etcd_object_counts metric reported by kube-apiserver (#94819, @tkashem) [SIG API Machinery]
• Fix network_programming_latency metric reporting for Endpoints/EndpointSlice deletions, where we don't have correct timestamp (#95363, @wojtek-t) [SIG Network and Scalability]
• Fix scheduler cache snapshot when a Node is deleted before its Pods (#95153, @alculquicondor) [SIG Scheduling]
• Fix the cloudprovider_azure_api_request_duration_seconds metric buckets to correctly capture the latency metrics. Previously, the majority of the calls would fall in the "+Inf" bucket. (#94943, @marwanad) [SIG Cloud Provider and Instrumentation]
• Fix: azure disk resize error if source does not exist (#93011, @andyzhangx) [SIG Cloud Provider]
• Fix: detach azure disk broken on Azure Stack (#94885, @andyzhangx) [SIG Cloud Provider]
• Fixed a bug where improper storage and comparison of endpoints led to excessive API traffic from the endpoints controller (#94937, @damemi) [SIG Apps, Network and Testing]
• Fixed a regression that sometimes prevented kubectl portforward to work when TCP and UDP services were configured on the same port (#94728, @amorenoz) [SIG CLI]
• Fixes a bug where EndpointSlices would not be recreated after rapid Service recreation. (#94730, @robscott) [SIG Apps, Network and Testing]
• Fixes a race condition in kubelet pod handling (#94774, @auxten) [SIG Node]
• Gracefully delete nodes when their parent scale set went missing (#95289, @bpineau) [SIG Cloud Provider]
• Kubeadm: relax the validation of kubeconfig server URLs. Allow the user to define custom kubeconfig server URLs without erroring out during validation of existing kubeconfig files (e.g. when using external CA mode). (#94816, @neolit123) [SIG Cluster Lifecycle]
• Kubeadm: warn but do not error out on missing "ca.key" files for root CA, front-proxy CA and etcd CA, during "kubeadm join --control-plane" if the user has provided all certificates, keys and kubeconfig files which require signing with the given CA keys. (#94988, @neolit123) [SIG Cluster Lifecycle]

14.3.4. Other (Cleanup or Flake)

• Masks ceph RBD adminSecrets in logs when logLevel >= 4 (#95245, @sfowl) [SIG Storage]
• Vsphere: improve logging message on node cache refresh event (#95236, @andrewsykim) [SIG Cloud Provider]

14.4. Dependencies

14.4.1. Added

Nothing has changed.

14.4.2. Changed

Nothing has changed.

14.4.3. Removed

Nothing has changed.

15. v1.19.2

15.1. Downloads for v1.19.2

15.1.1. Source Code

15.1.2. Client binaries

15.1.3. Server binaries

15.1.4. Node binaries

15.2. Changelog since v1.19.1

15.3. Changes by Kind

15.3.1. API Change

• Fix conversions for custom metrics. (#94654, @wojtek-t) [SIG Instrumentation]

15.3.2. Bug or Regression

• Fixed a panic in kubectl debug when pod has multiple init containers or ephemeral containers (#94580, @kiyoshim55) [SIG CLI]

15.3.3. Other (Cleanup or Flake)

• Update CNI plugins to v0.8.7 (#94367, @justaugustus) [SIG Cloud Provider, Network, Node, Release and Testing]

15.4. Dependencies

15.4.1. Added

Nothing has changed.

15.4.2. Changed

Nothing has changed.

15.4.3. Removed

Nothing has changed.

16. v1.19.1

16.1. Downloads for v1.19.1

16.1.1. Source Code

16.1.2. Client binaries

16.1.3. Server binaries

16.1.4. Node binaries

16.2. Changelog since v1.19.0

16.3. Changes by Kind

16.3.1. Bug or Regression

• Azure: fix a bug that kube-controller-manager would panic if wrong Azure VMSS name is configured (#94306, @knight42) [SIG Cloud Provider]

• Build/lib/release: Explicitly use '--platform' in building server images

  When we switched to go-runner for building the apiserver, controller-manager, and scheduler server components, we no longer reference the individual architectures in the image names, specifically in the 'FROM' directive of the server image Dockerfiles.

  As a result, server images for non-amd64 images copy in the go-runner amd64 binary instead of the go-runner that matches that architecture.

  This commit explicitly sets the '--platform=linux/${arch}' to ensure we're pulling the correct go-runner arch from the manifest list.

  Before: FROM ${base_image}

  After: FROM --platform=linux/${arch} ${base_image} (#94613, @justaugustus) [SIG Release]

• Fix a concurrent map writes error in kubelet (#93773, @knight42) [SIG Node]

• Fix a regression where kubeadm bails out with a fatal error when an optional version command line argument is supplied to the "kubeadm upgrade plan" command (#94421, @rosti) [SIG Cluster Lifecycle]
• Fixed bug in reflector that couldn't recover from "Too large resource version" errors with API servers 1.17.0-1.18.5 (#94316, @janeczku) [SIG API Machinery]
• Kubeadm: make the kubeconfig files for the kube-controller-manager and kube-scheduler use the LocalAPIEndpoint instead of the ControlPlaneEndpoint. This makes kubeadm clusters more reseliant to version skew problems during immutable upgrades: https://kubernetes.io/docs/setup/release/version-skew-policy/#kube-controller-manager-kube-scheduler-and-cloud-controller-manager (#94398, @neolit123) [SIG Cluster Lifecycle]
• Update default etcd server version to 3.4.13 (#94536, @jingyih) [SIG API Machinery, Cloud Provider, Cluster Lifecycle and Testing]
• Upon successful authorization check, an impersonated user is added to the system:authenticated group. system:anonymous when impersonated is added to the system:unauthenticated group. (#94408, @tkashem) [SIG API Machinery and Testing]
• Use NLB Subnet CIDRs instead of VPC CIDRs in Health Check SG Rules (#93515, @t0rr3sp3dr0) [SIG Cloud Provider]

16.3.2. Other (Cleanup or Flake)

• Fixes the flooding warning messages about setting volume ownership for configmap/secret volumes (#92878, @jvanz) [SIG Instrumentation, Node and Storage]
• Kubeadm: remove the CoreDNS check for known image digests when applying the addon (#94506, @neolit123) [SIG Cluster Lifecycle]

16.4. Dependencies

16.4.1. Added

Nothing has changed.

16.4.2. Changed

Nothing has changed.

16.4.3. Removed

Nothing has changed.

17. v1.19.0

Documentation

17.1. Downloads for v1.19.0

17.1.1. Source Code

17.1.2. Client Binaries

17.1.3. Server Binaries

17.1.4. Node Binaries

17.2. Changelog since v1.18.0

17.3. What’s New (Major Themes)

17.3.1. Deprecation warnings

SIG API Machinery implemented warnings when using deprecated APIs that are visible to kubectl users and API consumers, and metrics visible to cluster administrators. Requests to a deprecated API are returned with a warning containing a target removal release and any replacement API. Warnings can also be returned by admission webhooks, and specified for deprecated versions of custom resources.

17.3.2. Avoiding permanent beta

From Kubernetes 1.20 onwards, SIG Architecture will implement a new policy to transition all REST APIs out of beta within nine months. The idea behind the new policy is to avoid features staying in beta for a long time. Once a new API enters beta, it will have nine months to either:

• reach GA, and deprecate the beta, or
• have a new beta version (and deprecate the previous beta).

If a REST API reaches the end of that nine-month countdown, then the next Kubernetes release will deprecate that API version. More information can be found on the Kubernetes Blog.

17.3.3. Expanded CLI support for debugging workloads and nodes

SIG CLI expanded on debugging with kubectl to support two new debugging workflows: debugging workloads by creating a copy, and debugging nodes by creating a container in host namespaces. These can be convenient to:

• Insert a debug container in clusters that don’t have ephemeral containers enabled
• Modify a crashing container for easier debugging by changing its image, for example to busybox, or its command, for example, to sleep 1d so you have time to kubectl exec.
• Inspect configuration files on a node's host filesystem

Since these new workflows don’t require any new cluster features, they’re available for experimentation with your existing clusters via kubectl alpha debug. We’d love to hear your feedback on debugging with kubectl. Reach us by opening an issue, visiting #sig-cli or commenting on enhancement #1441.

17.3.4. Structured logging

SIG Instrumentation standardized the structure of log messages and references to Kubernetes objects. Structured logging makes parsing, processing, storing, querying and analyzing logs easier. New methods in the klog library enforce log message structure.

17.3.5. EndpointSlices are now enabled by default

EndpointSlices are an exciting new API that provides a scalable and extensible alternative to the Endpoints API. EndpointSlices track IP addresses, ports, readiness, and topology information for Pods backing a Service.

In Kubernetes 1.19 this feature will be enabled by default with kube-proxy reading from EndpointSlices instead of Endpoints. Although this will mostly be an invisible change, it should result in noticeable scalability improvements in large clusters. It will also enable significant new features in future Kubernetes releases like Topology Aware Routing.

17.3.6. Ingress graduates to General Availability

SIG Network has graduated the widely used Ingress API to general availability in Kubernetes 1.19. This change recognises years of hard work by Kubernetes contributors, and paves the way for further work on future networking APIs in Kubernetes.

17.3.7. seccomp graduates to General Availability

The seccomp (secure computing mode) support for Kubernetes has graduated to General Availability (GA). This feature can be used to increase the workload security by restricting the system calls for a Pod (applies to all containers) or single containers.

Technically this means that a first class seccompProfile field has been added to the Pod and Container securityContext objects:

securityContext:
  seccompProfile:
    type: RuntimeDefault|Localhost|Unconfined # choose one of the three
    localhostProfile: my-profiles/profile-allow.json # only necessary if type == Localhost