Amazon VPC CNI: Kubernetes 1.8+ Manifests

[ripta]

This is a follow-up of PR #5119, which adds a separate addon manifest for Kubernetes 1.8+, as suggested by @mikesplain in this code review.

Namely, the only difference is that the new manifest for Kubernetes 1.8+ has the apiVersion rbac.authorization.k8s.io/v1 instead of rbac.authorization.k8s.io/v1beta1 for Kubernetes 1.7.

[ripta]

Placing this on hold until #5119 is merged.

/hold

[mikesplain]

/ok-to-test

[mikesplain]

@ripta Great thanks for the PR!

/assign

[mikesplain]

Here's an idea, what if you also add a 1.10 manifest to this PR (with the 1.8 change as well), removing the k8s-ec2-srcdst like we talked about (it shouldn't be neccessary and isn't in AWS' official docs). Could be worth getting the discussion going on that now, but not injecting change for those running 1.8/1.9? That said, if users are currently running k8s-ec2-srcdst, removing it here shouldn't stop it in the cluster... so it may not be a big deal.

Thoughts?

Anyone else have thoughts, @chrislovecnm @justinsb @rdrgmnzs @chrisz100

[justinsb]

I think that's a good suggestion @mikesplain. There's a number of changes around the VPC CNI plugin that we need to coordinate it looks like!

I believe RBAC v1beta1 is supported in 1.8 & 1.9 - I think we have a moratorium on any version removal at the moment. So what do you think @ripta?

[ripta]

@justinsb - Sounds fine. I had planned on submitting the removal of k8s-ec2-srcdst as a separate PR, mainly because I probably won't have time to validate that setup this week.

[justinsb]

I propose we do this in kops 1.11 - it seems to be a cleanup for 1.10, and then we have plenty of time to look at the srcdst work etc

[ripta]

@mikesplain - I finally had the chance to add a k8s 1.10 version of the manifest that removes srcdst. Can you take a look?

Also, I wasn't entirely clear re: v1beta1. Were you saying that we should keep the API version at v1beta1 for 1.8/1.9?

[justinsb]

Thanks @ripta - this LGTM and the time is right!

For the API versions, we're not removing API versions, so v1beta1 should continue to work until we change the removal policy. We have to be careful that v1 is actually supported in the versions we're targeting - in this case in 1.8, and it was indeed introduced in 1.8 so this should work.

Technically we need to bump the version in bootstrapchannelbuilder.go, but I'll take a look at that as part of figuring out the other PRs!

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb, ripta

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ripta]

Thanks for taking a look and for the explanation, @justinsb.

Let me know if you want me to do that version bump (I can open a separate PR) and double-check to make sure the manifests are up-to-date.