[2.12 branch] Backport Kubernetes 1.16.8 (#5770) (#5774)

* Backport Kubernetes 1.16.8 (#5770)

* Kubernetes 1.16.8

* Upgrade etcd to 3.3.12 (#5718)

* Use kubespray 2.11.2 as start version for the upgrade test case

.gitlab-ci.yml

@@ -38,7 +38,7 @@ before_script:
   tags:
     - packet
   variables:
-    KUBESPRAY_VERSION: v2.11.0
+    KUBESPRAY_VERSION: v2.11.2
   image: quay.io/kubespray/kubespray:$KUBESPRAY_VERSION
 
 .testcases: &testcases

README.md

@@ -112,8 +112,8 @@ Note: Upstart/SysV init based OS types are not supported.
 ## Supported Components
 
 - Core
-  - [kubernetes](https://github.com/kubernetes/kubernetes) v1.16.7
-  - [etcd](https://github.com/coreos/etcd) v3.3.10
+  - [kubernetes](https://github.com/kubernetes/kubernetes) v1.16.8
+  - [etcd](https://github.com/coreos/etcd) v3.3.12
   - [docker](https://www.docker.com/) v18.06 (see note)
   - [cri-o](http://cri-o.io/) v1.14.0 (experimental: see [CRI-O Note](docs/cri-o.md). Only on centos based OS)
 - Network Plugin

inventory/sample/group_vars/k8s-cluster/k8s-cluster.yml

@@ -20,7 +20,7 @@ kube_users_dir: "{{ kube_config_dir }}/users"
 kube_api_anonymous_auth: true
 
 ## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.16.7
+kube_version: v1.16.8
 
 # kubernetes image repo define
 kube_image_repo: "{{ gcr_image_repo }}/google-containers"

roles/container-engine/containerd/templates/rh_containerd.repo.j2

@@ -7,13 +7,3 @@ keepcache={{ docker_rpm_keepcache | default('1') }}
 gpgkey={{ docker_rh_repo_gpgkey }}
 {% if http_proxy is defined %}proxy={{ http_proxy }}{% endif %}
 {% if ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 8 %}module_hotfixes=True{% endif %}
-
-[docker-engine]
-name=Docker-Engine Repository
-baseurl={{ dockerproject_rh_repo_base_url }}
-enabled=1
-gpgcheck=1
-keepcache={{ docker_rpm_keepcache | default('1') }}
-gpgkey={{ dockerproject_rh_repo_gpgkey }}
-{% if http_proxy is defined %}proxy={{ http_proxy }}{% endif %}
-{% if ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 8 %}module_hotfixes=True{% endif %}

roles/container-engine/containerd/templates/rh_docker.repo.j2

@@ -0,0 +1,9 @@
+[docker-ce]
+name=Docker-CE Repository
+baseurl={{ docker_rh_repo_base_url }}
+enabled=1
+gpgcheck=1
+keepcache={{ docker_rpm_keepcache | default('1') }}
+gpgkey={{ docker_rh_repo_gpgkey }}
+{% if http_proxy is defined %}proxy={{ http_proxy }}{% endif %}
+{% if ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 8 %}module_hotfixes=True{% endif %}

roles/container-engine/docker/defaults/main.yml

@@ -38,11 +38,6 @@ docker_ubuntu_repo_gpgkey: 'https://download.docker.com/linux/ubuntu/gpg'
 # Debian docker-ce repo
 docker_debian_repo_base_url: "https://download.docker.com/linux/debian"
 docker_debian_repo_gpgkey: 'https://download.docker.com/linux/debian/gpg'
-# dockerproject repo
-dockerproject_rh_repo_base_url: 'https://yum.dockerproject.org/repo/main/centos/7'
-dockerproject_rh_repo_gpgkey: 'https://yum.dockerproject.org/gpg'
-dockerproject_apt_repo_base_url: 'https://apt.dockerproject.org/repo'
-dockerproject_apt_repo_gpgkey: 'https://apt.dockerproject.org/gpg'
 docker_bin_dir: "/usr/bin"
 # CentOS/RedHat Extras repo
 extras_rh_repo_base_url: "http://mirror.centos.org/centos/$releasever/extras/$basearch/"

roles/container-engine/docker/tasks/main.yml

@@ -27,9 +27,6 @@
   tags:
     - facts
 
-# https://yum.dockerproject.org/repo/main/opensuse/ contains packages for an EOL
-# openSUSE version so we can't use it. The only alternative is to use the docker
-# packages from the distribution repositories.
 - name: Warn about Docker version on SUSE
   debug:
     msg: "SUSE distributions always install Docker from the distro repos"
@@ -105,9 +102,14 @@
   when: ansible_distribution == "Fedora" and not is_atomic
 
 - name: Configure docker repository on RedHat/CentOS/Oracle Linux
-  template:
-    src: "rh_docker.repo.j2"
-    dest: "{{ yum_repo_dir }}/docker.repo"
+  yum_repository:
+    name: docker-ce
+    baseurl: "{{ docker_rh_repo_base_url }}"
+    description: "Docker CE Stable - $basearch"
+    gpgcheck: yes
+    gpgkey: "{{ docker_rh_repo_gpgkey }}"
+    keepcache: "{{ docker_rpm_keepcache | default('1') }}"
+    proxy: " {{ http_proxy | default('_none_') }}"
   when: ansible_distribution in ["CentOS","RedHat","OracleLinux"] and not is_atomic
 
 - name: check if container-selinux is available

roles/container-engine/docker/tasks/pre-upgrade.yml

@@ -1,4 +1,12 @@
 ---
+- name: Remove legacy docker repo file
+  file:
+    path: "{{ yum_repo_dir }}/docker.repo"
+    state: absent
+  when:
+    - ansible_distribution in ["CentOS","RedHat","OracleLinux"]
+    - not is_atomic
+
 - name: Ensure old versions of Docker are not installed. | Debian
   apt:
     name: '{{ docker_remove_packages_apt }}'

roles/container-engine/docker/templates/rh_docker.repo.j2

@@ -1,19 +0,0 @@
-[docker-ce]
-name=Docker-CE Repository
-baseurl={{ docker_rh_repo_base_url }}
-enabled=1
-gpgcheck=1
-keepcache={{ docker_rpm_keepcache | default('1') }}
-gpgkey={{ docker_rh_repo_gpgkey }}
-{% if http_proxy is defined %}proxy={{ http_proxy }}{% endif %}
-{% if ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 8 %}module_hotfixes=True{% endif %}
-
-[docker-engine]
-name=Docker-Engine Repository
-baseurl={{ dockerproject_rh_repo_base_url }}
-enabled=1
-gpgcheck=1
-keepcache={{ docker_rpm_keepcache | default('1') }}
-gpgkey={{ dockerproject_rh_repo_gpgkey }}
-{% if http_proxy is defined %}proxy={{ http_proxy }}{% endif %}
-{% if ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 8 %}module_hotfixes=True{% endif %}

roles/container-engine/docker/vars/debian.yml

@@ -2,7 +2,6 @@
 docker_kernel_min_version: '3.10'
 
 # https://download.docker.com/linux/debian/
-# https://apt.dockerproject.org/repo/dists/debian-wheezy/main/filelist
 docker_versioned_pkg:
   'latest': docker-ce
   '1.13': docker-engine=1.13.1-0~debian-{{ ansible_distribution_release|lower }}
@@ -38,7 +37,7 @@ docker_repo_info:
 
 dockerproject_repo_key_info:
   pkg_key: apt_key
-  url: '{{ dockerproject_apt_repo_gpgkey }}'
+  url: '{{ docker_debian_repo_gpgkey }}'
   repo_keys:
     - 58118E89F3A912897C070ADBF76221572C52609D
 
@@ -46,6 +45,6 @@ dockerproject_repo_info:
   pkg_repo: apt_repository
   repos:
     - >
-       deb {{ dockerproject_apt_repo_base_url }}
+       deb {{ docker_debian_repo_base_url }}
        {{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}
        main

roles/container-engine/docker/vars/redhat.yml

@@ -3,7 +3,6 @@ docker_kernel_min_version: '0'
 
 # https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
 # https://download.docker.com/linux/centos/7/x86_64/stable/Packages/
-# https://yum.dockerproject.org/repo/main/centos/7
 # or do 'yum --showduplicates list docker-engine'
 docker_versioned_pkg:
   'latest': docker-ce

roles/container-engine/docker/vars/ubuntu-amd64.yml

@@ -37,7 +37,7 @@ docker_repo_info:
 
 dockerproject_repo_key_info:
   pkg_key: apt_key
-  url: '{{ dockerproject_apt_repo_gpgkey }}'
+  url: '{{ docker_debian_repo_gpgkey }}'
   repo_keys:
     - 58118E89F3A912897C070ADBF76221572C52609D
 
@@ -45,6 +45,6 @@ dockerproject_repo_info:
   pkg_repo: apt_repository
   repos:
     - >
-       deb {{ dockerproject_apt_repo_base_url }}
+       deb {{ docker_debian_repo_base_url }}
        {{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}
        main

roles/container-engine/docker/vars/ubuntu-arm64.yml

@@ -33,7 +33,7 @@ docker_repo_info:
 
 dockerproject_repo_key_info:
   pkg_key: apt_key
-  url: '{{ dockerproject_apt_repo_gpgkey }}'
+  url: '{{ docker_debian_repo_gpgkey }}'
   repo_keys:
     - 58118E89F3A912897C070ADBF76221572C52609D
 
@@ -41,6 +41,6 @@ dockerproject_repo_info:
   pkg_repo: apt_repository
   repos:
     - >
-       deb {{ dockerproject_apt_repo_base_url }}
+       deb {{ docker_debian_repo_base_url }}
        {{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}
        main

roles/download/defaults/main.yml

@@ -49,9 +49,9 @@ download_delegate: "{% if download_localhost %}localhost{% else %}{{ groups['kub
 image_arch: "{{host_architecture | default('amd64')}}"
 
 # Versions
-kube_version: v1.16.7
+kube_version: v1.16.8
 kubeadm_version: "{{ kube_version }}"
-etcd_version: v3.3.10
+etcd_version: v3.3.12
 
 # gcr and kubernetes image repo define
 gcr_image_repo: "gcr.io"
@@ -121,6 +121,7 @@ crictl_checksums:
 kubelet_checksums:
   arm:
     v1.17.0: 75ae6ad8f4a7f2ac3988b37a01c28093f240745d17c1781135d1844057c8ae94
+    v1.16.8: e3ac093071ad59f726ae0f88d1d10ada7ec559ed2b7817495339f4380ae32057
     v1.16.7: ace84b05e4de55042ed4288eab14f33a5a23519ee7d9981be25b0cf3e74172c2
     v1.16.6: 0fa3e0836bc0c7395d71c831ad2772f4baa9f4e13a5280228a53958340c95944
     v1.16.5: c7a224bd0786594902dfd20a21d5377f005f5fe6624550fdfd8bcb8c015d4a0f
@@ -140,6 +141,7 @@ kubelet_checksums:
     v1.15.0: 663c59fca7247ca325d4328cfc3ce77d1d4eddb251137f91ec62b8cd8823d1fc
   arm64:
     v1.17.0: b1a4a2325383854a69ec768e7dc00f69378d3ccbc554859d910bf5b582264ea2
+    v1.16.8: a6889c9957d8ec3ba15676b1e2eff021c9d120284f185d367626763dd15a245b
     v1.16.7: bdfa1638e285e4665d9888770eb69aabfa6c08bcc8c6a2285bc06909c68fa4a0
     v1.16.6: be9f90fec92d0e82a0f4f7005d1dbaa6e31877d48716452b86c7a7db097c53c4
     v1.16.5: 10513b0a7845ff475a18f25a45e39cb73a35203102abee4701d8de7c0377b6ba
@@ -159,6 +161,7 @@ kubelet_checksums:
     v1.15.0: a16443434eb0391991bff9a10288d83beb38be4d406954858d9fdc1063870284
   amd64:
     v1.17.0: c2af77f501c3164e80171903028d35c632366f53dec0c8419828d4e55d86146f
+    v1.16.8: 4573da19fed14c84f4434ab7cbedf5ded4bf89710c078d58c0703cf2332df198
     v1.16.7: f49755b06848914c2729353d3580199a70ec8d732609660e90214b4f48ff4398
     v1.16.6: 47b99b6b9c4654a3fd5e3f093763429f8a6007f788bd7394bd0b85cb7ae4b2d0
     v1.16.5: f146a59db12869fd1dbe5fe58d6d03eba59989fff63766f488a4fea3fd7dd713
@@ -180,6 +183,7 @@ kubelet_checksums:
 kubectl_checksums:
   arm:
     v1.17.0: 594b3e2f89dca09d82b176b51bf6c8c0fa524ed209c14ec915c9b36fa876601d
+    v1.16.8: 803c3197845fd5f97c99bcba6e7a0af223128442deccca92df2d267d545db166
     v1.16.7: 588ac4f1387442d0b0d8928080a7f42c1196ae9b0b9a3d6a25b048df26926e26
     v1.16.6: 57b37697e4fae53b68786eaef5a2ea14cca38f62e9478aebd758648370c64608
     v1.16.5: 06302f893a171260bf89c4cd7a1caa130f0290cf6e11ef9e83cac54c9c7c94f5
@@ -199,6 +203,7 @@ kubectl_checksums:
     v1.15.0: 3ea07f7fa18309a630a9f317582de742befbf8efdcb22300a192941b4075c16f
   arm64:
     v1.17.0: cba12bfe0ee447b06f00813d7d4ba3fbdbf5116eccc4d3291987044f2d6f93c2
+    v1.16.8: d08aab5f02db63690672e5d9052659589301323c010d90734788d5332ac99daa
     v1.16.7: 404289fded50daeba0f66e36275498164f17ab121f6cd3cfb1bea6b85914c6e5
     v1.16.6: 4b852e138a3adc8378ab6ce863144b328924535cc118e33eb1d6245af81a0fbb
     v1.16.5: cb0142172c3a23a68d5c6194fcc599b58269eff1b47b817ac235e6dfac5b842f
@@ -218,6 +223,7 @@ kubectl_checksums:
     v1.15.0: db05f4c1799e019d5ebc51737f31132c191ffce13c516fa758e7137173abd855
   amd64:
     v1.17.0: 6e0aaaffe5507a44ec6b1b8a0fb585285813b78cc045f8804e70a6aac9d1cb4c
+    v1.16.8: 1d8602496ca4b843824a9746206509991eb8d30b5bb8436b36a02718729934ed
     v1.16.7: c31ca51b526489cd929be71fc1dc9c3cc24b6df5641b3505b467bac51862047d
     v1.16.6: 05aae29c6e96fc07db195878263d3b625b623b9f16f87851e4a8ed8d234bcc2d
     v1.16.5: 2f1bd0736cabbc660882a46b4188b0e7eb2085760a89fb84017cc8df7cd416d0
@@ -239,6 +245,7 @@ kubectl_checksums:
 kubeadm_checksums:
   arm:
     v1.17.0: 5fcf1234d89bc2a364c53b76b36134fc57278b456138d93c278805f2c9b186f1
+    v1.16.8: df7737c2ffbd6001fabbed7c84e9ab4f483f750aff5e6052c245a7978ab203af
     v1.16.7: 66dfa31f5ebd96b3f3a0243533772d68602d36c0e6c0114f4c004cd9c4bed481
     v1.16.6: e7e19b2edacd811a81a6147235efbbea31029d9b1c51261eab393db50e618f65
     v1.16.5: 83e0162a6b67ea12767eb8b90f245a1a97ab4c5bc19abda291861008038bba18
@@ -258,6 +265,7 @@ kubeadm_checksums:
     v1.15.0: 9464030a1d4e101de5f47348f3514d5a9eb95cbce2e5e31f53ada1ca485cf75e
   arm64:
     v1.17.0: 0b94d1ace240a8f9995358ca2b66ac92072e3f3cd0543275b315dcd317798546
+    v1.16.8: 2300e2a7dc16512595c7aebc486799239039d33f33db2d085550d1f2d5f3129b
     v1.16.7: 90b69bdebefea6496335485d24bd9829e16029bbc7aa771749044cecd1a60360
     v1.16.6: f170c10da4824cdba274f1a8b37f1358b147c3224c47ad363fb80c8a2c13e54b
     v1.16.5: c24ee225b5cad870491b5febcd12846fb2730439b4b843cb151d0c31d5f0ab5e
@@ -277,6 +285,7 @@ kubeadm_checksums:
     v1.15.0: fe3c79070814fe847a23209b1027672fe5c5e7e5c9611e329225058926836f96
   amd64:
     v1.17.0: 0d8443f50fb7caab2e5e7e53f9dc56d5ffe55f021ec061f2e2bcba0481df5a48
+    v1.16.8: 58a74986af13b969abc8b471822f36f3fda71f95ed1c006f48c8d2ab88f8edf1
     v1.16.7: 018f7c2fae7a1ce7bc892edbea3ee2c493e4b023436be9f8f65fd392dc3e17b6
     v1.16.6: dd4364fa61e7e3767066607395b771cf6fcd0fc57df82c7142fd33183cc6ef9e
     v1.16.5: c68082771f752fa5b6c3ea8e4b19ebbd270d23da14372c8b72dbae65e8a7c4a5
@@ -299,8 +308,8 @@ etcd_binary_checksums:
   # Etcd does not have arm32 builds at the moment, having some dummy value is
   # required to avoid "no attribute" error
   arm: 0
-  arm64: 5ec97b0b872adce275b8130d19db314f7f2b803aeb24c4aae17a19e2d66853c4
-  amd64: 1620a59150ec0a0124a65540e23891243feb2d9a628092fb1edcc23974724a45
+  arm64: 170b848ac1a071fe7d495d404a868a2c0090750b2944f8a260ef1c6125b2b4f4
+  amd64: dc5d82df095dae0a2970e4d870b6929590689dd707ae3d33e7b86da0f7f211b6
 cni_binary_checksums:
   arm: ae6ddbd87c05a79aceb92e1c8c32d11e302f6fc55045f87f6a3ea7e0268b2fda
   arm64: acde854e3def3c776c532ae521c19d8784534918cc56449ff16945a2909bff6d

roles/kubernetes/preinstall/defaults/main.yml

@@ -54,3 +54,5 @@ etc_hosts_localhost_entries:
 # Minimal memory requirement in MB for safety checks
 minimal_node_memory_mb: 1024
 minimal_master_memory_mb: 1500
+
+yum_repo_dir: /etc/yum.repos.d

roles/kubernetes/preinstall/tasks/0070-system-packages.yml

@@ -17,6 +17,14 @@
   tags:
     - bootstrap-os
 
+- name: Remove legacy docker repo file
+  file:
+    path: "{{ yum_repo_dir }}/docker.repo"
+    state: absent
+  when:
+    - ansible_distribution in ["CentOS","RedHat","OracleLinux"]
+    - not is_atomic
+
 - name: Install python-dnf for latest RedHat versions
   command: dnf install -y python-dnf yum
   register: dnf_task_result

roles/kubespray-defaults/defaults/main.yaml

@@ -12,7 +12,7 @@ is_atomic: false
 disable_swap: true
 
 ## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.16.7
+kube_version: v1.16.8
 
 ## The minimum version working
 kube_version_min_required: v1.15.0