alpha to beta

cluster/config-defaults.yaml

@@ -127,7 +127,7 @@ logging_fluentd_cpu: "100m"
 logging_s3_bucket: "zalando-logging-{{.InfrastructureAccount | getAWSAccountID}}-{{.Region}}"
 logging_agent_in_visibility: "true"
 scalyr_team_token: ""
-logging_agent_version: "v0.31"
+logging_agent_version: "v0.32"
 
 zmon_redis_mem: "1Gi"
 zmon_agent_mem: "500Mi"
@@ -200,7 +200,7 @@ teapot_admission_controller_validate_application_label: "false"
 {{end}}
 
 {{if eq .Environment "e2e"}}
-teapot_admission_controller_ignore_namespaces: "^kube-system|(e2e-tests-(downward-api|kubectl|projected|statefulset|pod-network)-.*)$"
+teapot_admission_controller_ignore_namespaces: "^kube-system|((downward-api|kubectl|projected|statefulset|pod-network)-.*)$"
 {{else}}
 teapot_admission_controller_ignore_namespaces: "^kube-system$"
 {{end}}
@@ -219,8 +219,8 @@ cluster_dns: "coredns"
 coredns_log_svc_names: "true"
 
 coreos_image: "ami-0d1579b60bb706fb7" # Container Linux 2079.6.0 (HVM, eu-central-1)
-kuberuntu_image: {{ amiID "zalando-ubuntu-kubernetes-production-v1.13.10-master-54" "861068367966" }}
 
+kuberuntu_image: {{ amiID "zalando-ubuntu-kubernetes-production-v1.14.6-master-56" "861068367966" }}
 
 # Feature toggle to allow gradual decommissioning of ingress-template-controller
 enable_ingress_template_controller: "false"
@@ -256,6 +256,9 @@ node_cidr_mask_size: "24" # Default: 24
 # maximum number of PIDs allowed to be allocated per pod
 pod_max_pids: "4096"
 
+# the cpu management policy which should be used by the kubelet
+cpu_manager_policy: "none"
+
 # when set to true, routes external traffic to the apiserver through a skipper sidecar
 apiserver_proxy: "true"
 # when set to true, service account tokens can be used from outside the cluster

cluster/manifests/01-visibility/priority-logging.yaml

@@ -1,4 +1,4 @@
-apiVersion: scheduling.k8s.io/v1alpha1
+apiVersion: scheduling.k8s.io/v1
 kind: PriorityClass
 metadata:
   name: visibility-logging

cluster/manifests/01-visibility/priority.yaml

@@ -1,4 +1,4 @@
-apiVersion: scheduling.k8s.io/v1alpha1
+apiVersion: scheduling.k8s.io/v1
 kind: PriorityClass
 metadata:
   name: visibility-zmon

cluster/manifests/emergency-access-service/ingress.yaml

@@ -1,5 +1,5 @@
 {{ if eq .Environment "production" }}
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   name: emergency-access-service

cluster/manifests/external-dns/deployment.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: external-dns
-    version: v0.5.15
+    version: v0.5.16
 spec:
   strategy:
     type: Recreate
@@ -16,7 +16,7 @@ spec:
     metadata:
       labels:
         application: external-dns
-        version: v0.5.15
+        version: v0.5.16
 {{ if eq .ConfigItems.kube_aws_iam_controller_kube_system_enable "false"}}
       annotations:
         iam.amazonaws.com/role: "{{ .LocalID }}-app-external-dns"
@@ -30,7 +30,7 @@ spec:
       serviceAccountName: external-dns
       containers:
       - name: external-dns
-        image: pierone.stups.zalan.do/teapot/external-dns:v0.5.15
+        image: pierone.stups.zalan.do/teapot/external-dns:v0.5.16
         args:
         - --source=service
         - --source=ingress

cluster/manifests/kube-cluster-autoscaler/autoscaling-priority-class.yaml

@@ -1,4 +1,4 @@
-apiVersion: scheduling.k8s.io/v1alpha1
+apiVersion: scheduling.k8s.io/v1
 kind: PriorityClass
 metadata:
   name: autoscaling-buffer

cluster/manifests/kube-downscaler/deployment.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: kube-downscaler
-    version: v0.12
+    version: v0.18
 spec:
   replicas: 1
   selector:
@@ -15,7 +15,7 @@ spec:
     metadata:
       labels:
         application: kube-downscaler
-        version: v0.12
+        version: v0.18
     spec:
       dnsConfig:
         options:
@@ -26,14 +26,13 @@ spec:
       containers:
       - name: downscaler
         # see https://github.com/hjacobs/kube-downscaler/releases
-        image: registry.opensource.zalan.do/teapot/kube-downscaler:0.14
+        image: registry.opensource.zalan.do/teapot/kube-downscaler:0.18
         args:
           - --interval=30
           - --exclude-namespaces=kube-system,visibility
           - --exclude-deployments=kube-downscaler,downscaler,postgres-operator
           - "--default-uptime={{ .ConfigItems.downscaler_default_uptime }}"
-          - --kind=stack
-          - --kind=deployment
+          - --include-resources=stacks,deployments
         resources:
           limits:
             cpu: 5m

cluster/manifests/kube-proxy/daemonset.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: kube-proxy
-    version: v1.13.7
+    version: v1.14.6
 spec:
   selector:
     matchLabels:
@@ -17,7 +17,7 @@ spec:
       name: kube-proxy
       labels:
         application: kube-proxy
-        version: v1.13.7
+        version: v1.14.6
       annotations:
         config/hash: {{"configmap.yaml" | manifestHash}}
     spec:
@@ -31,7 +31,7 @@ spec:
       hostNetwork: true
       containers:
       - name: kube-proxy
-        image: registry.opensource.zalan.do/teapot/kube-proxy:v1.13.7
+        image: registry.opensource.zalan.do/teapot/kube-proxy:v1.14.6
         args:
         - --hostname-override=$(HOSTNAME_OVERRIDE)
         - --config=/config/kube-proxy.yaml

cluster/manifests/logging-agent/daemonset.yaml

@@ -83,7 +83,7 @@ spec:
           mountPath: /mnt/scalyr-checkpoint
       containers:
       - name: log-watcher
-        image: registry.opensource.zalan.do/logging/kubernetes-log-watcher:0.31
+        image: registry.opensource.zalan.do/logging/kubernetes-log-watcher:0.33
         env:
         - name: CLUSTER_NODE_NAME
           valueFrom:
@@ -139,7 +139,7 @@ spec:
 
       - name: scalyr-agent
 
-        image: registry.opensource.zalan.do/eagleeye/scalyr-agent:0.5
+        image: registry.opensource.zalan.do/eagleeye/scalyr-agent:master-8
 
         env:
         # Note: added for scalyr-config-base, but not needed by the scalyr-agent itself.

cluster/manifests/prometheus/configmap.yaml

@@ -81,14 +81,11 @@ data:
       scheme: http
       kubernetes_sd_configs:
       - role: endpoints
-        namespaces:
-          names:
-            - kube-system
       relabel_configs:
       # Look for the Prometheus annotations and scrape based on those
-      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
+      - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_endpoints_name, __meta_kubernetes_service_annotation_prometheus_io_scrape]
         action: keep
-        regex: true
+        regex: ^(kube-system;.*?|default;stackset-controller);true$
       - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
         action: replace
         target_label: __scheme__

cluster/manifests/prometheus/ingress.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   annotations:
     zalando.org/skipper-filter: |
-      oauthTokeninfoAnyScope("uid")
+      oauthTokeninfoAnyKV("realm", "/employees", "realm", "/services")
   labels:
     application: prometheus
 spec:

cluster/manifests/skipper/deployment.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: skipper-ingress
-    version: v0.10.271
+    version: v0.10.273
     component: ingress
 spec:
   strategy:
@@ -18,7 +18,7 @@ spec:
     metadata:
       labels:
         application: skipper-ingress
-        version: v0.10.271
+        version: v0.10.273
         component: ingress
       annotations:
         kubernetes-log-watcher/scalyr-parser: |
@@ -42,7 +42,7 @@ spec:
       hostNetwork: true
       containers:
       - name: skipper-ingress
-        image: registry.opensource.zalan.do/pathfinder/skipper:v0.10.271
+        image: registry.opensource.zalan.do/pathfinder/skipper:v0.10.273
         ports:
         - name: ingress-port
           containerPort: 9999

cluster/manifests/zmon-agent/deployment.yaml

@@ -47,7 +47,7 @@ spec:
             readOnly: false
       containers:
         - name: zmon-agent
-          image: "pierone.stups.zalan.do/zmon/zmon-agent-core:0.4-2-ga5bdbee-zv5"
+          image: "pierone.stups.zalan.do/zmon/zmon-agent-core:0.4-11-gf8f2ced-zv5"
           resources:
             limits:
               cpu: {{.ConfigItems.zmon_agent_cpu}}

cluster/manifests/zmon-worker/deployment.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: visibility
   labels:
     application: zmon-worker
-    version: "v208-py2eol-zv250-py2eol-2-gbe56be1"
+    version: "v209-py2eol-v251-py2eol"
 spec:
   replicas: {{.ConfigItems.zmon_worker_replicas}}
   selector:
@@ -15,7 +15,7 @@ spec:
     metadata:
       labels:
         application: zmon-worker
-        version: "v208-py2eol-zv250-py2eol-2-gbe56be1"
+        version: "v209-py2eol-v251-py2eol"
       annotations:
         iam.amazonaws.com/role: "{{ .LocalID }}-app-zmon"
     spec:
@@ -46,7 +46,7 @@ spec:
             readOnly: false
       containers:
         - name: zmon-worker
-          image: "pierone.stups.zalan.do/zmon/zmon-worker:v208-py2eol-zv250-py2eol-2-gbe56be1"
+          image: "pierone.stups.zalan.do/zmon/zmon-worker:v209-py2eol-v251-py2eol"
           resources:
             limits:
               cpu: {{.ConfigItems.zmon_worker_cpu}}

cluster/node-pools/master-default/userdata.clc.yaml

@@ -180,7 +180,7 @@ systemd:
       After=docker.service dockercfg.service meta-data-iptables.service private-ipv4.service
 
       [Service]
-      Environment=KUBELET_IMAGE_TAG=v1.13.7
+      Environment=KUBELET_IMAGE_TAG=v1.14.6
       Environment=KUBELET_IMAGE_ARGS=--exec=/kubelet
       Environment=KUBELET_IMAGE_URL=docker://registry.opensource.zalan.do/teapot/kubelet
       Environment="RKT_RUN_ARGS=--insecure-options=image \
@@ -361,7 +361,7 @@ storage:
           namespace: kube-system
           labels:
             application: kube-apiserver
-            version: v1.13.7
+            version: v1.14.6
           annotations:
             kubernetes-log-watcher/scalyr-parser: |
               [{"container": "webhook", "parser": "json-structured-log"}]
@@ -373,7 +373,7 @@ storage:
           hostNetwork: true
           containers:
           - name: kube-apiserver
-            image: registry.opensource.zalan.do/teapot/kube-apiserver:v1.13.7
+            image: registry.opensource.zalan.do/teapot/kube-apiserver:v1.14.6
             args:
             - --apiserver-count={{ .Values.apiserver_count }}
             - --bind-address=0.0.0.0
@@ -711,15 +711,15 @@ storage:
           namespace: kube-system
           labels:
             application: kube-controller-manager
-            version: v1.13.7
+            version: v1.14.6
         spec:
           priorityClassName: system-node-critical
           tolerations:
           - key: node-role.kubernetes.io/master
             effect: NoSchedule
           containers:
           - name: kube-controller-manager
-            image: registry.opensource.zalan.do/teapot/kube-controller-manager:v1.13.7
+            image: registry.opensource.zalan.do/teapot/kube-controller-manager:v1.14.6
             args:
             - --kubeconfig=/etc/kubernetes/controller-kubeconfig
             - --leader-elect=true
@@ -780,7 +780,7 @@ storage:
           namespace: kube-system
           labels:
             application: kube-scheduler
-            version: v1.13.7
+            version: v1.14.6
         spec:
           priorityClassName: system-node-critical
           tolerations:
@@ -789,7 +789,7 @@ storage:
           hostNetwork: true
           containers:
           - name: kube-scheduler
-            image: registry.opensource.zalan.do/teapot/kube-scheduler:v1.13.7
+            image: registry.opensource.zalan.do/teapot/kube-scheduler:v1.14.6
             args:
             - --master=http://127.0.0.1:8080
             - --leader-elect=true
@@ -1248,7 +1248,7 @@ storage:
           --volume dns,kind=host,source=/run/systemd/resolve/resolv.conf,readOnly=true \
           --mount volume=dns,target=/etc/resolv.conf \
           --net=host \
-          docker://registry.opensource.zalan.do/teapot/kubectl:v1.13.7 \
+          docker://registry.opensource.zalan.do/teapot/kubectl:v1.14.6 \
           --exec=/kubectl -- \
           --kubeconfig=/etc/kubernetes/kubeconfig \
           label node "$(hostname)" \
@@ -1261,7 +1261,7 @@ storage:
           --net=host \
           --volume dns,kind=host,source=/run/systemd/resolve/resolv.conf,readOnly=true \
           --mount volume=dns,target=/etc/resolv.conf \
-          docker://registry.opensource.zalan.do/teapot/kubectl:v1.13.7 \
+          docker://registry.opensource.zalan.do/teapot/kubectl:v1.14.6 \
           --exec=/kubectl -- \
           --kubeconfig=/etc/kubernetes/kubeconfig \
           drain "$(hostname)" \

cluster/node-pools/worker-default/userdata.clc.yaml

@@ -179,7 +179,7 @@ systemd:
       After=docker.service dockercfg.service meta-data-iptables.service private-ipv4.service collect-instance-metadata.service
 
       [Service]
-      Environment=KUBELET_IMAGE_TAG=v1.13.7
+      Environment=KUBELET_IMAGE_TAG=v1.14.6
       Environment=KUBELET_IMAGE_ARGS=--exec=/kubelet
       Environment=KUBELET_IMAGE_URL=docker://registry.opensource.zalan.do/teapot/kubelet
       Environment="RKT_RUN_ARGS=--insecure-options=image \
@@ -488,7 +488,7 @@ storage:
           --volume dns,kind=host,source=/run/systemd/resolve/resolv.conf,readOnly=true \
           --mount volume=dns,target=/etc/resolv.conf \
           --net=host \
-          docker://registry.opensource.zalan.do/teapot/kubectl:v1.13.7 \
+          docker://registry.opensource.zalan.do/teapot/kubectl:v1.14.6 \
           --exec=/kubectl -- \
           --kubeconfig=/etc/kubernetes/kubeconfig \
           label node "$(hostname)" \
@@ -501,7 +501,7 @@ storage:
           --net=host \
           --volume dns,kind=host,source=/run/systemd/resolve/resolv.conf,readOnly=true \
           --mount volume=dns,target=/etc/resolv.conf \
-          docker://registry.opensource.zalan.do/teapot/kubectl:v1.13.7 \
+          docker://registry.opensource.zalan.do/teapot/kubectl:v1.14.6 \
           --exec=/kubectl -- \
           --kubeconfig=/etc/kubernetes/kubeconfig \
           drain "$(hostname)" \

cluster/node-pools/worker-ubuntu-default/userdata.yaml

@@ -53,6 +53,7 @@ write_files:
         SupportPodPidsLimit: true
       podPidsLimit: {{ .NodePool.ConfigItems.pod_max_pids }}
 {{- end }}
+      cpuManagerPolicy: {{ .NodePool.ConfigItems.cpu_manager_policy }}
       maxPods: {{ .Cluster.ConfigItems.node_max_pods }}
       healthzPort: 10248
       healthzBindAddress: "0.0.0.0"

test/e2e/Makefile

@@ -2,7 +2,7 @@
 
 BINARY       ?= kubernetes-on-aws-e2e
 VERSION      ?= $(shell git describe --tags --always --dirty)
-KUBE_VERSION ?= v1.13.5
+KUBE_VERSION ?= v1.14.6
 IMAGE        ?= registry-write.opensource.zalan.do/teapot/$(BINARY)
 TAG          ?= $(VERSION)
 DOCKERFILE   ?= Dockerfile