Støtte EKS 1.22 i Okctl

[Kielo87]

Okctl må støtte gitt versjon av EKS.

Dette er en oversikts-task, man kan delegeere til nye, mindre tasks etter behov.

Bakgrunn

Amazon EKS Kubernetes versions - Amazon EKS
Updating an Amazon EKS cluster Kubernetes version - Amazon EKS
Amazon EKS platform versions - Amazon EKS
Deprecated API Migration Guide

---

Bumpe EKS versjon

• Knownbinaries: kubectl for gitt EKS verjson
• Fiks at eksctl setter opp gitt EKS versjon
• Test funksjonalitet: Se https://github.com/oslokommune/ykctl/blob/main/testing.md
• Sjekk om noe må gjøres mtp https://github.com/prometheus-operator/kube-prometheus#compatibility

---

1.22 Spesifikt

• Bump AWS load balancer controller, ref https://docs.aws.amazon.com/eks/latest/userguide/update-cluster.html#update-1.22 (ctrl+f "you must update it to version 2.4.1")
• Bumpe external secrets controller (pga utgåtte ressurstyper)
• Bump CSIDriver (reconciler: persistent storage)
• Trenger vi bumpe aws-iam-authenticator mon tro? https://stackoverflow.com/a/71319893/915441
• Melding i EKS panelet i AWS console: The Kubernetes BoundServiceAccountTokenVolume feature introduced an expiration time to service account tokens. This feature is enabled by default in EKS v1.21 and later clusters. You may have to update your application dependencies to refetch service account tokens to avoid API server request errors.Learn more https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html#kubernetes-1.21

---

1.22 utgåtte ressurser

• Ingress (brukes i apply application. Andre steder?) - Dekkes av bytte-fra-ingress-ingress-networkingv1beta1-til-v1
• PodSecurityPolicy? Sjekk om vi har det noe steder.
• Sjekk lenkene i description for om det er noen andre.

---

Lage upgrades

• AWS load balancer controller 2.4.1 eller nyere
• External secrets controller
• CSIDriver / storage driver
• aws-iam-authenticator (hvis vi trenger det, se over)

---

Diverse

• Oppdatere med påkrevd versjon av Okctl: https://github.com/oslokommune/okctl-upgrade/tree/main/gists/bump-eks#eks-122

---

Kommentar fra Yngvar 15 Aug 2022

Noen utgåtte ressurstyper:

. applying cluster: reconciling persistent storage

warnings.go:70] storage.k8s.io/v1beta1 CSIDriver is deprecated in v1.19+, unavailable in v1.22+; use storage.k8s.io/v1 CSIDriver

---

Noen utgåtte ressurstyper, fra apply cluster. Antakeligvis vil det det å bumpe load balancer controller fikse dette.

.. applying cluster: reconciling AWS Load Balancer controller

warnings.go:70] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition

warnings.go:70] admissionregistration.k8s.io/v1beta1 MutatingWebhookConfiguration is deprecated in v1.16+, unavailable in v1.22+; use admissionregistration.k8s.io/v1 MutatingWebhookConfiguration

warnings.go:70] admissionregistration.k8s.io/v1beta1 ValidatingWebhookConfiguration is deprecated in v1.16+, unavailable in v1.22+; use admissionregistration.k8s.io/v1

---

Noen utgåtte ressurstyper, fra delete cluster:

deleting cluster: reconciling secrets controller

warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding

warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding

deleting cluster: reconciling secrets controller

warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRole

---

Yngvar Kristiansen 15 Aug at 14:59
Sjekk når podsecuritypolicy som brukes av bl.a. loki blir deprekert og når det slutter å funke