@smarterclayton smarterclayton released this Oct 11, 2018 · 703 commits to master since this release

Assets 7

This is the 3.11 release of OpenShift Origin.

Backwards Compatibility

  • auth: The auth reconcile command is now deprecated as its functionality is part of the server #20177
    • The CLI command is now identical to the upstream auth reconcile and no longer updates roles
  • auth: The cluster-reader RBAC role is now an aggregated role to simplify adding new permissions #20279
  • cli: oc patch is now consistent with the kubectl patch command #20665
  • cli: oc types is now deprecated - use oc api-resources instead #21000
  • security: If the scheduler.alpha.kubernetes.io/node-selector annotion is set on a namespace, openshift.io/node-selector is now ignored #21058
  • server: The openshift start node functionality and openshift start have been removed - the Kubelet must now be started directly #20344, #20717
    • By using the Kubelet directly we make nodes easier to manage and more consistent with the upstream.
    • Future releases will remove other parts of openshift start master.

Changes

Roadmap for the v3.11 release

v3.11.0 (2018-10-10) Full Changelog

API

  • build: Allow dashes to be used in the environment variable names in builds #20738
  • image: Return information about image layers that are associated with an image stream to improve registry performance #19969, #20643
  • security: Promote sysctl annotations to fields in SecurityContextConstraints #20151

Component updates

  • Updated to Kubernetes v1.11.0-62-gd4cacc0 + patches
    • 62943: set updated replicas in statefulsets #20347
    • 64378: Don't reset global timeout on each for loop iteration #20452
    • 64426: Clean up fake mounters. #20117
    • 64447: Add block volume support to internal provisioners #20058
    • 64541: Add more kubectl auth reconcile flags #20281
    • 64860:checkLimitsForResolvConf for the pod create and update events instead of checking period #20070
    • 64879: Add block volume support to Cinder volume plugin #20270
    • 64896: kubectl: wait for all errors and successes on podEviction #20452
    • 65189: fix paths w shortcuts when copying from pods #20034
    • 65189: revert: fix paths w shortcuts when copying from pods" #20075
    • 65226: Put all the node address cloud provider retrival complex logic into cloudResourceSyncManager #20615
    • 65238: fix scheduler port boundary to match detection #20033
    • 65326: fix printer check to tolerate vendoring #20033
    • 65329: make builder tolerant of restmapper failures when it doesn't need the answer #20033
    • 65367: make sure delete waiting doesn't re-evaluate the resource lists #20033
    • 65368: legacy api endpoints only support v1 ever #20033
    • 65370: delete should tolerate a failed wait because of missing verbs #20033
    • 65377: special-case templates get.go #20033
    • 65447: Resolve potential devicePath symlink when MapVolume #20117
    • 65480: allow enabling kubelet serving certificate rotation via flag #20033
    • 65486: show type differences in reflect diff #20033
    • 65488: flatten nested lists for flatten in visitor #20033
    • 65489: kubectl convert should not double wrap output in nested lists #20033
    • 65547: Honor custom transport dialer #20033
    • 65549: Fix flexvolume in containerized kubelets #20358
    • 65587: Revert "certs: only append locally discovered addresses when we got none from the cloudprovider" #20033
    • 65686: fix kubectl create priorityclass failure bug #20624
    • 65700: Update output format so that it matches actual accepted values #20139
    • 65705: Block volumes should have empty FSType #20327
    • 65711: make template printers a recommended printer #20257
    • 65715: fail on rbac resources of non-v1 versions in reconcile #20177
    • 65786: update --template printer defaulting #20257
    • 65856: only need to ignore resources that match discovery conditions #20242
    • 65899: use self-signed cert fixtures in integration test servers #20309
    • 65904: track schemes by name for error reporting #20242
    • 65906: Improve multi-authorizer errors #20379
    • 65908: switch delete strategy to background deletion #20274
    • 65987: Add region label to dynamic provisioned cinder PVs #20418
    • 66008: Convert TestServerRunWithSNI to subtests to isolate flake #20302
    • 66085: fix updateJob scheduling of resync #20763
    • 66136: make delete waits match on UID #20305
    • 66172: Reverting commit #56600 as GCE PD is allocated in chunks of GiB inste... #20418
    • 66225: add support for "success" output for edit command #20589
    • 66225: update testcase for edit #20589
    • 66249: fill in normal restmapping info with the legacy guess #20392
    • 66324: Fixing E2E tests for disk resizing #20418
    • 66350: Start cloudResourceSyncsManager before getNodeAnyWay (initializeModules) to avoid kubelet getting stuck in retrieving node addresses from a cloudprovider #20615
    • 66352: update logs cmd to deal w external versions #20343
    • 66397: Fix upper limit on m5/c5 instance typesn #20439
    • 66398: fix logs command to be generic for all resources again #20514
    • 66403: indicate which scheme has conflicting data #20372
    • 66406: Send correct headers for pod printing #20437
    • 66406: tolerate missing column headers in server-side print output #20437
    • 66464: Avoid overflowing int64 in RoundUpSize and return error if overflow int #20418
    • 66519: switch attach to use external objs #20514
    • 66725: update exit code to 0 if patch not needed #20456
    • 66779: add methods to apimachinery to easy unit testing #20471
    • 66835: cloudprovider: aws: return true on existence check for stopped instances #20663
    • 66837: fix panic fake SAR client expansion #20491
    • 66929: add logging to find offending transports #20554
    • 66931: Use the passed-in streams in kubectl top #20529
    • 66932: Include unavailable apiservices in discovery response #20635
    • 67024: add CancelRequest to discovery round-tripper #20554
    • 67033: expose default LogsForObject consumeRequest func #20550
    • 67093: improve config file modification time #20566
    • 67094:Fix incorrect reporting of total request including current pod in the resource allocation priority function. #20603
    • 67094:Ouput volumes (total capacity and requests) too along with cpu and memory when the feature BalanceAttachedNodeVolumes is used. #20603
    • 67097: Ignore EIO error in unmount path #20866
    • 67236: fix azure disk create failure due to sdk upgrade #20662
    • 67316: Adds tests for --all-containers=true #20684
    • 67399: update patch to work with --local and avoid extra requests #20642
    • 67399: update patch to work with --local and avoid extra requests #20665
    • 67433: allow failed discovery on initial quota controller start #20635
    • 67433: allow failed discovery on initial quota controller start #20693
    • 67493: Tolerate nil input in GetValueFromIntOrPercent #20532
    • 67615: attach: Move the AttachFunc default function to the initializer #20697
    • 67698: Fix NameFromCommandArgs when passing command after -- #20730
    • 67822: Remove provisioner config from log message. #20756
    • 67835: Tests that use CheckTestingNSDeletedExcept must be serial #18816
    • 67896: expose generic storage factory primitives #20777
    • 67957: Size http2 buffers to allow concurrent streams #20783
    • 68007: Orphan DaemonSet when deleting with --cascade option set #20793
    • 68008: apiserver: forward panic in WithTimeout filter #20979
    • 68563: fix scheduler crash when Prioritize Map function failed #21194
    • 68678: tighten maximum retry loop for aggregate api availability #21012
    • 68680: Fix chown on distributed flex volumes (like gluster) #21070
    • : Node selector aware DS controller should not process openshift-io/node-selector if scheduler.alpha.kubernetes.io/node-selector is set. #21058
    • : Coerce string->int, empty object -> slice for backwards compatibility #20164
    • : Ensure perFSGroup quanity is positive #20564
    • : Expose ns lifecyle admission list of allowed resources #20242
    • : Gracefully handle empty volume-config file #20154
    • : oc patches on kubectl #20721
    • : patch in a non-standard location for apiservices #20578
    • : rewrite unstructured objects on the CLI to avoid oapi #20033
    • : simplify kube-controller-manager patches #20954
    • : switch back to use ugorji/go - decode to signed integers #20033
    • : tidy up oc patches and ensure we never print a non-groupified object #20385
    • : GCE load balancer unit test is flaky #20230
    • : Remove influxdb dependency until the next rebase #18816
    • : carry old printers until we update #20033
    • : carry old printers until we update #20257
    • : Fix cloud provider vsphere data race #20033
    • : Increase loglevel for health check #20616
    • : Make auth reconcile work with backlevel versions until ansible updates #20033
    • : vSphere test has race conditions, disable #20231

Features

  • build: Support ConfigMaps as sources in build definitions - allows you to have config from the build #19655, #20064
  • cli: Add oc image append which can add a new layer or change metadata on a Docker image against a remote registry #20027
  • cli: Add oc image extract to extract all or part of an image to disk from any platform #20466
  • cli: Support SSPI (Kerberos authentication) on Windows for the command line #11371
  • cli: Include the kubectl binary in release output #20932, #20958, #20900
  • network: Support automatic and highly available egress IPs for applications #19578, #20485, #21085, #20258, #20500
  • router: Support for mutual TLS authentication between the router and service backends. #19891, #20476
  • router: Allow HAProxy to dynamically change backends without requiring a reload #19073, #20559, #20557, #20630, #20646

Bugs

  • auth: Add namespaced servicebrokers, serviceclasses and serviceplans to admin/edit/view ClusterRoles #20852
  • auth: Update GitLab IDP to support OIDC #19997
  • auth: Use the upstream RBAC roles for reconciliation #20638
  • build: Ensure OOMKilled reason from pods are reported on build status #20297
  • build: Move deployer and build binaries into oc #20011 #20008
  • build: Remove false alarm warning for repo binary input on oc start-build #20100
  • cli: Allow patching configapi using oc patch #20642
  • cli: Honor 'oc edit' output format #20589
  • cli: accept --kubeconfig like kubectl #20721
  • cluster: Cluster quota controller tolerate inaccessible api resources #20693
  • deploy: Be tolerant on deployment decode and strict on encode to prevent incorrect fields #20185
  • deploy: Fix printing DC replicas #21017
  • dns: Restore graceful shutdown of DNS server #21021
  • image: Deprecate oc import-image legacy path using annotations #19673
  • image: Image stream imports longer than 30s should not fail #20419
  • image: Log image changes on verify-image-signature without --save #19976
  • image: Prune images in parallel #19468
  • image: Reuse existing imagestreams with new-app #20052
  • migrate: Ignore resources that cannot be listed and updated #21075
  • network: Bug 1614660 - Network diagnostic will auto detect runtime #20647
  • network: Show EgressCIDRs in "oc get hostsubnets" #20486
  • network: Update egress IPs when node changes IP #20393
  • node: Set FileCheckFrequency default properly #20158
  • route: Fix issue where routes are not cleaned up when a namespace label is deleted or updated. #20579
  • router: Bug 1618563 - Use the TCP balance scheme if configured before falling back to the default router load balancing algo #20702
  • router: Fix weight logic for A/B testing #19893
  • router: HAProxy ip whitelist exceeding max config arguments that haproxy allows. #20357
  • router: Router metrics sometimes fails to detect HTTP/1 connections #21043
  • service-catalog: use K8s NamespaceLifecycle admission controller #20673
  • test: Enable a large chunk of upstream e2e tests that were accidentally not being run #18816

Release SHA256 Checksums

The latest artifacts are always located at https://artifacts-openshift-release-3-11.svc.ci.openshift.org/zips/

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  CHECKSUM
4b0f07428ba854174c58d2e38287e5402964c9a9355f6c359d1242efd0990da3  openshift-origin-client-tools-v3.11.0-0cbc58b-linux-64bit.tar.gz
9bfcd70df56d902b2cd39dea06e73f4c5451ef9e2ad0e8d6d5b27a92af8503fc  openshift-origin-server-v3.11.0-0cbc58b-linux-64bit.tar.gz
75d58500aec1a2cee9473dfa826c81199669dbc0f49806e31a13626b5e4cfcf0  openshift-origin-client-tools-v3.11.0-0cbc58b-mac.zip
cdb84cc0000d0f0983120f903b2cad7114527ce2a9c4eb1988986eda7b877bfa  openshift-origin-client-tools-v3.11.0-0cbc58b-windows.zip