v2.14.0

Announcements

We are looking for maintainers, reach out in #5432.

[Azure] Update documentation with az command (#6042)
[Azure] Add azure_cloud parameter to cloud_config file (#6321)
[CSI] Update CSI containers to latest versions (#6221)
[MetalLB] Option to talk BGP (#6383)
[MetalLB] The deployment becomes one of addons. You can deploy it with a new option metallb_enabled (#6238)
[Openstack] Support volume type (#6524) (See Notes)
[Openstack] Make it possible to open additional ports on masters (#6547)
[Openstack] Add support for application credentials (#6534)
[Openstack] Add snapshot-controller for CSI drivers (#6537)
[Openstack] Added a default volumesnapshotclass for Cinder CSI (#6537)

Match docker-cli version with docker-engine version (#6163)
[Docker] Set cgroup driver by default to systemd (#6563)
[Containerd] Install package is now managed alongside docker (#6218)
[Containerd] Add support for Fedora (#6094)
[CRI-O] Use OS packaging default value for apparmor_profile in crio.conf (#6125)
[CRI-O] Fix kubelet cgroup driver detection (#6331)
[CRI-O] Align template crio.conf with upstream and set cgroup driver by default to systemd (#6432)
[CRI-O] Harden downloads with retry (#6374)
[CRI-O] Add variable to configure unsecure pull (#6568)

[Weave] Allow Weave DS to support any taint effect (#6159)
[Calico] Disable bird-check flag for probes of calico-node pods when calico_network_backend is not bird (#6217)
[Calico] Add FELIX_DEVICEROUTESOURCEADDRESS option (#6508)
[Kube-Router] Enable portmap CNI plugin with kube-router to allow use of hostPort in container specs (#6204)
[Kube-Router] Add selectable dns policy (#6586)
[Cilium] Add a way to deploy cilium alongside another CNI (#6373)
[Cilium] Add option to configure IPVS timeouts in kube-proxy configration manifest (#6396)
[Cilium] Support the overwrite of MTU in Cilium agents (#6329)
[Cilium] Add metrics in Cilium operator and add hubble metrics port in agents (#6513)
[Cilium] Add hubble server support in cilium (#6575)

Create custom dashboard namespace if specified (#6107)
Add support to expose etcd metrics on a custom port (#6092)
Add additional network configuration options to external Openstack (#6085)
Fix resolv.conf configuration for Fedora CoreOS (#6138)
Replace seccomp profile docker/default with runtime/default (#6170)
Multiples fixes for proxy and no_proxy variables (#6112 #6431 #6558)
Use connection: local when delegate_to: localhost (#6322)
Add DNS configuration in NetworkManager for Fedora CoreOS (#6291)
Allow kubeadm to upgrade etcd (#6345) (See notes)
Add docs for setting up your first cluster (#6544)
Webhook authorization can now be enabled using inventory variable (#6502)
Uncordon node that fail to drain (thus failing its upgrade) during upgrade procedure (#6546)
Added variable kubelet_rotate_server_certificates which enables kubelet server certificate rotation (#6453)
Add protectKernelDefaults option (default true) to kubelet config file (#6611)

None

etcd will now be upgraded and its certs renewed when using a kubeadm managed etcd (etcd_kubeadm_enabled: true)
Cilium: Check upgrade guide regarding update to 1.8.0
Kube-Router: Upgrade to 1.0.0 require an iptable flush
Kube-ovn is now installed in kube-system namespace, version priori to 1.0.0 should be removed manually
Cert-Manager: Refer to README.md prior to upgrading in your exisitng Kubernetes cluster
Openstack: If the nova API is before Stein, Terraform will work but the new volume type feature will not be available. If the entire cloud is upgraded to Stein or later, the new feature can be used. However if the nova versions in the cloud are mixed, with nova server API >= Stein and any nova-compute node < Stein, you will get a HTTP 409 error and VolumeTypeSupportNotYetAvailable exception.