Add support for newer Docker versions #7860

hakman · 2019-10-31T09:46:48Z

What type of PR is this?
/kind feature

What this PR does / why we need it:
Updates supported Docker versions to latest stable. Previous versions for Docker CE are EOL.

Which issue(s) this PR fixes:
Fixes #7463
Fixes #7853

Special notes for your reviewer:
At the moment the default Docker version in Kops is 18.06.3, quite old and EOL. Docker version 18.09 has been officially validated since k8s 1.14, but it's EOL also at the moment also.

Docker 19.03 has been stable for some time and has been validated for k8s 1.14+ since June, just not documented. kubernetes/kubernetes#82326 (comment)
Test infrastructure has been moved to Docker 19.03 also. kubernetes/test-infra#14784
Website should be getting updated instructions for installing Docker soon. kubernetes/website#17405

IMHO, adding support Docker 19.03 and 18.09 should be a useful from stability and security point of view.

Hash check passed for all packages:

$ VERIFY_HASHES=1 go test ./nodeup/pkg/model
ok  	k8s.io/kops/nodeup/pkg/model	191.029s

I tested the changes with Debian Stretch and Buster, Ubuntu Bionic, RHEL 7 and 8.
The only issue I noticed was the iptables-legacy setup that will be addressed by #7379.

$ kubectl get nodes -o wide

NAME                     STATUS   ROLES    AGE   VERSION    INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                                      KERNEL-VERSION                  CONTAINER-RUNTIME
ip-10-2-1-85.internal    Ready    node     46m   v1.11.10   10.2.1.85     <none>        Debian GNU/Linux 9 (stretch)                  4.9.0-11-amd64                  docker://19.3.4
ip-10-2-1-104.internal   Ready    node     56m   v1.11.10   10.2.1.104    <none>        Debian GNU/Linux 10 (buster)                  4.19.0-6-amd64                  docker://19.3.4
ip-10-2-1-122.internal   Ready    node     10m   v1.11.10   10.2.1.122    <none>        Ubuntu 18.04.3 LTS                            4.15.0-1051-aws                 docker://19.3.4
ip-10-2-1-15.internal    Ready    node     12h   v1.11.10   10.2.1.15     <none>        Red Hat Enterprise Linux Server 7.7 (Maipo)   3.10.0-1062.1.2.el7.x86_64      docker://19.3.4
ip-10-2-1-79.internal    Ready    node     1m    v1.11.10   10.2.1.79     <none>        Red Hat Enterprise Linux 8.0 (Ootpa)          4.18.0-80.4.2.el8_0.x86_64      docker://19.3.4

Does this PR introduce a user-facing change?:

Default Docker version will change to 18.09.9 for k8s >= 1.14 and 19.03.4 for k8s >= 1.17.
Users will be able to manually select version 19.03.4.

spec:
  docker:
    version: 19.03.4

k8s-ci-robot · 2019-10-31T09:46:56Z

Hi @hakman. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

hakman · 2019-10-31T09:50:47Z

/assign @justinsb

k8s-ci-robot · 2019-11-04T10:58:30Z

@hakman: Re-titling can only be requested by trusted users, like repository collaborators.

In response to this:

/retitle Add support for newer Docker versions

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

hakman · 2019-11-04T19:52:02Z

/cc @mikesplain

zetaab

Seems ok for me.

/lgtm
/ok-to-test

justinsb · 2019-11-07T21:11:12Z

pkg/model/components/docker.go

-		if sv.Major == 1 && sv.Minor >= 12 {
+		if sv.Major == 1 && sv.Minor >= 17 {
+			dockerVersion = "19.03.4"
+		} else if sv.Major == 1 && sv.Minor >= 14 {


While this might be a good idea, we do have a policy of not changing the defaults on existing clusters, and we have shipped kops 1.14. Would you mind making this >= 15, therefore?

(And we'll have to cherry-pick back to 1.15...)

Otherwise I cross checked and the versions look good, k8s 1.15 supports 18.09, k8s 1.17 adds support for 19.03 - thank you!

I still haven't figured out the support policy for Docker, but I have nothing against bumping to >= 15.

From security point of view, it is hard to tell if there are any issues with 18.06.3. Not being an EE release, it is unmaintained since Feb. I didn't see anything that caught my eye in the Docker release notes, but Contained seems to have many "notable updates" including CVE fixes since then.

One idea would be to cherry-pick only the package definitions to released versions. This way, any user can upgrade Docker at its own risk.

justinsb · 2019-11-07T21:15:25Z

Thank you so much for doing this @hakman - this is great, except that we really shouldn't change the behaviour for k8s/kops 1.14 (now that we've released kops 1.14.0). If there's a really important security issue we can consider it, but I'm not aware of one, so I just proposed changing >= 1.15 instead?

hakman · 2019-11-08T04:14:34Z

/test pull-kops-bazel-test

hakman · 2019-11-08T05:12:30Z

/test pull-kops-e2e-kubernetes-aws

hakman · 2019-11-08T06:46:45Z

Thank you @justinsb. I appreciate you taking the time to review this and considering it for the 1.15 release.
I updated the changes to apply only to >= 1.15. Please let me know if I need to do anything for the cherry-pick back to 1.15, still new here.

hakman · 2019-11-08T10:25:44Z

/test pull-kops-e2e-kubernetes-aws

hakman · 2019-11-08T18:11:00Z

@justinsb minimum version to apply defaults changed to 1.16 as discussed during Office Hours. Thanks again!

mikesplain · 2019-11-17T19:08:07Z

Thanks @hakman! This looks great and thank you for adjusting things for 1.16. Since that looks like the only issue, lets get this in.

/lgtm
/approve

k8s-ci-robot · 2019-11-17T19:08:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hakman, mikesplain

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [mikesplain]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

mikesplain · 2019-11-17T19:10:47Z

I also confirmed that these are the validated docker version from release docs. Thanks! 👍

hakman · 2019-11-18T09:12:30Z

Thanks @mikesplain @justinsb.
Should this still be cherry-picked to 1.15?

Cherry pick of #7860 onto release-1.15

jhohertz · 2019-11-21T15:55:35Z

Not sure this is working, set the version per the above w/ 1.15.0 final, and still end up with 18.06-ce.

hakman · 2019-11-21T18:39:12Z

@jhohertz I already have a cluster upgraded with Docker 19.03.4. No clues in kops output during the upgrade?

jhohertz · 2019-11-21T19:22:53Z

I'd forgotten that the docker version management is a no-op for CoreOS @hakman, sorry for any confusion.

hakman · 2019-11-21T19:33:27Z

No problem @jhohertz. I see some Flatcar has some 19.03.4 in their Edge channel. I guess it will take a bit longer to get to their stable release.

Add support for Docker 19.03.4

a716ac1

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 31, 2019

k8s-ci-robot requested review from granular-ryanbonham and zetaab October 31, 2019 09:48

k8s-ci-robot assigned justinsb Oct 31, 2019

Add support for Docker 18.09.9

7772659

hakman changed the title ~~Add support for Docker 19.03.4~~ Add support for newer Docker versions Nov 4, 2019

k8s-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Nov 4, 2019

k8s-ci-robot requested a review from mikesplain November 4, 2019 19:52

zetaab approved these changes Nov 4, 2019

View reviewed changes

k8s-ci-robot assigned zetaab Nov 4, 2019

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 4, 2019

hakman mentioned this pull request Nov 5, 2019

docker/centos7 - Add missing selinux-policy dependency #7878

Closed

justinsb reviewed Nov 7, 2019

View reviewed changes

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 8, 2019

hakman closed this Nov 8, 2019

hakman reopened this Nov 8, 2019

hakman force-pushed the docker-19.03.4 branch from 99c75bc to 07312a3 Compare November 8, 2019 09:26

Update Docker version defaults

3e07810

hakman force-pushed the docker-19.03.4 branch from 9abe4eb to 3e07810 Compare November 9, 2019 05:23

k8s-ci-robot assigned mikesplain Nov 17, 2019

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 17, 2019

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 17, 2019

k8s-ci-robot merged commit baa5ae3 into kubernetes:master Nov 17, 2019

hakman deleted the docker-19.03.4 branch November 18, 2019 08:55

justinsb mentioned this pull request Nov 19, 2019

Cherry pick of #7860 onto release-1.15 #7951

Merged

k8s-ci-robot added a commit that referenced this pull request Nov 19, 2019

Merge pull request #7951 from justinsb/cherrypick_7860_release-1.15

5d4cdb0

Cherry pick of #7860 onto release-1.15

hakman mentioned this pull request Nov 19, 2019

kops v1.12.1 still shipped with vulnerable docker-ce? #7216

Closed

kaviarasan-ex2 mentioned this pull request Jul 23, 2020

Nodeup error for docker 18.09.9_ kops upgrade from 15.03 to 16.04_Selinux_Dependency Packages are missing_AMI kernel mismatch. #9615

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for newer Docker versions #7860

Add support for newer Docker versions #7860

hakman commented Oct 31, 2019 •

edited

Loading

k8s-ci-robot commented Oct 31, 2019

hakman commented Oct 31, 2019

k8s-ci-robot commented Nov 4, 2019

hakman commented Nov 4, 2019

zetaab left a comment

justinsb Nov 7, 2019

hakman Nov 8, 2019

hakman Nov 8, 2019

justinsb commented Nov 7, 2019

hakman commented Nov 8, 2019

hakman commented Nov 8, 2019

hakman commented Nov 8, 2019

hakman commented Nov 8, 2019

hakman commented Nov 8, 2019

mikesplain commented Nov 17, 2019

k8s-ci-robot commented Nov 17, 2019

mikesplain commented Nov 17, 2019

hakman commented Nov 18, 2019

jhohertz commented Nov 21, 2019

hakman commented Nov 21, 2019

jhohertz commented Nov 21, 2019

hakman commented Nov 21, 2019

Add support for newer Docker versions #7860

Add support for newer Docker versions #7860

Conversation

hakman commented Oct 31, 2019 • edited Loading

k8s-ci-robot commented Oct 31, 2019

hakman commented Oct 31, 2019

k8s-ci-robot commented Nov 4, 2019

hakman commented Nov 4, 2019

zetaab left a comment

Choose a reason for hiding this comment

justinsb Nov 7, 2019

Choose a reason for hiding this comment

hakman Nov 8, 2019

Choose a reason for hiding this comment

hakman Nov 8, 2019

Choose a reason for hiding this comment

justinsb commented Nov 7, 2019

hakman commented Nov 8, 2019

hakman commented Nov 8, 2019

hakman commented Nov 8, 2019

hakman commented Nov 8, 2019

hakman commented Nov 8, 2019

mikesplain commented Nov 17, 2019

k8s-ci-robot commented Nov 17, 2019

mikesplain commented Nov 17, 2019

hakman commented Nov 18, 2019

jhohertz commented Nov 21, 2019

hakman commented Nov 21, 2019

jhohertz commented Nov 21, 2019

hakman commented Nov 21, 2019

hakman commented Oct 31, 2019 •

edited

Loading