Container Service for Kubernetes (ACK) complies with the Certified Kubernetes Conformance Program. This topic describes what changed in ACK to support Kubernetes 1.16.
Kubernetes 1.16 removes several API versions by default. Check whether your workloads use the deprecated APIs listed below before you upgrade. ACK extended backward compatibility for these APIs through Kubernetes 1.16.6, but support ends in Kubernetes 1.18.
Component versions
| Component | Version | Changes |
|---|---|---|
| Kubernetes | 1.16.9 | Fixed CVE-2020-8555 in kube-controller-manager. See Vulnerability fixed: CVE-2020-8555 in kube-controller-manager. If your cluster uses disk volumes of the Block Volume type, read Update notes for CSI block volumes before upgrading. |
| Kubernetes | 1.16.6 | CoreDNS upgraded from 1.3.1 (Kubernetes 1.14) to 1.6.2. The proxy plugin is replaced by the forward plugin for higher performance. The ready plugin is now enabled by default to check container readiness. The Corefile is automatically migrated. |
| Docker | 19.03.5 (containerd 1.2.10) | See Docker 19.03.5 changes. |
| etcd | 3.4.3 | — |
What changed in Kubernetes 1.16
API deprecations
The following API versions are removed in Kubernetes 1.16 by default. Action required: Check whether your workloads use these APIs and update your manifests to the replacement versions before upgrading.
| Deprecated API | Replacement |
|---|---|
apps/v1beta1 |
apps/v1 |
apps/v1beta2 |
apps/v1 |
extensions/v1beta1 (DaemonSets, Deployments, ReplicaSets) |
apps/v1 |
extensions/v1beta1 (NetworkPolicies) |
networking.k8s.io/v1 |
ACK extended backward compatibility for these APIs through Kubernetes 1.16.6. Support ends in Kubernetes 1.18. Update your manifests and tooling before upgrading to Kubernetes 1.18.
Performance improvements
Kubernetes 1.16.6 includes the following improvements over Kubernetes 1.14:
-
PodAffinity scheduling: ~100% faster.
-
List operations: pod listing is 40% faster; node listing is 30% faster.
-
Server-side apply: improved performance when handling large map objects.
-
Node heartbeat: the node lease-based heartbeat reduces API server and etcd load by 50,000 queries per minute in an 8,000-node cluster.
-
Pod creation: for stateless pods (no ConfigMaps, Secrets, or volumes), 99% of pods start within 5 seconds once images are pulled. The slowest 1% of pod creations drop from ~5 seconds (Kubernetes 1.14) to ~3 seconds (Kubernetes 1.16.6).
Kubelet security parameter changes
The following kubelet parameters are deprecated and removed: AllowPrivileged, HostNetworkSources, HostPIDSources, and HostIPCSources. Access control is now handled through PodSecurityPolicy and equivalent mechanisms.
Features reaching general availability
-
CustomResourceDefinitions (CRDs)
-
Admission webhooks
Docker 19.03.5 changes
Performance improvements:
-
Built-in BuildKit speeds up image builds.
-
Optimized systemd detection for runc reduces container startup time and memory consumption.
Bug fixes:
-
Fixed intermittent pod restarts during exec probe health checks.
-
Fixed CVE-2018-15664 (exposed via the
docker cpcommand). -
Fixed Docker becoming unresponsive when a rich container running multiple processes exits.
-
Fixed a handle leak in containerd.
ACK enhancements to Kubernetes 1.16.6
Stability and performance
-
Added retries for idempotent operations to improve cluster creation success rate.
-
Running containers are no longer restarted during kubelet upgrades.
-
Fixed kubelet startup failures caused by hugetlb.
Observability
-
Optimized Server Load Balancer (SLB) liveness probe logs sent to the API server.
-
Adjusted the log level of aggregationcontroller.
-
Improved output of the
get cscommand in ACK managed clusters. -
Optimized monitoring metrics for sandboxed containers to maintain compatibility with existing metrics APIs.